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VOLUME XIX 
IN THE UNITED STATES ARMY 

UNITED STATES 
VS. 

MANNING, Bradley E., PFC COURT-MARTIAL 
U.S. Army, xxx— xx— 9504 

Headquarters and Headquarters Company, 

U.S. Army Garrison, 

Joint Base Myer— Henderson Hall, 

Fort Myer, VA 22211 

/ 

The Hearing in the above— entitled matter was 
continued on Thursday, July 18, 2013, commencing at 2:00 
p.m., at Fort Meade, Maryland, before the Honorable 
Colonel Denise Lind, Judge. 
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DISCLAIMER 

This transcript was made by a court reporter 
who is not the official Government reporter, was not 
permitted to be in the actual courtroom where the 
proceedings took place, but in a media room listening 
to and watching live audio/video feed, not permitted to 
make an audio backup recording for editing purposes, 
and not having the ability to control the proceedings 
in order to produce an accurate verbatim transcript . 

This unedited, uncertified draft transcript 
may contain court reporting outlines that are not 
translated, notes made by the reporter for editing 
purposes, misspelled terms and names, word combinations 
that do not make sense, and missing testimony or 
colloquy due to being inaudible by the reporter. 
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PROCEEDINGS, 
(Reconvened at 2:30 p.m.) 

THE COURT : The Court is called to order . 
Major Fein. According to the Court's last recess all 
present with the exception Captain Morrow is out and 
Captain Whyte is present. Also, Your Honor, Captain 
Von Elsten is absent, Captain Bouregard is present. 

MR. COOMBS: Just one quick alibi on the 
641 argument. I just wanted to point out on the 
databases both the CIDNE — on the CIDNE-I and CIDNE-A 
database you have testimony from witnesses that the 
database was made up of multiple tables, SigActs were 
one of those tables. You also had counter ID, you had 
PSYOPS . You had Humity reports, but these were other 
tables under the CIDNE-I and CIDNE-A database . 

The database was not made exclusively of 

SigActs . 

THE COURT: Who was that witness, do you 

remember? 

MR. COOMBS: All of the unit witnesses that 
testified for the government . So all of the unit 



Provided by Freedom of the Press Foundation 



1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 



UNOFFICIAL DRAFT - 7/18/13 Afternoon Session 



6 

witnesses talked about the other things on the CIDNE— I 
or CIDNE— A database . 

THE COURT: Government, do you contest 

that . 

MAJOR FEIN: Your Honor, United States 
doesn't necessarily contest that the CIDNE system 
had other types of information in it which the 
United States says that testimony, but was charged 
with the CIDNE database containing certain number of 
SigActs . So it's a focus on the SigActs side of the 
database . 

THE COURT : All right . Before we proceed I 
was advised over the lunch recess that at an earlier 
proceeding today there was a cell phone or other 
digital device in the courtroom. I'll remind the 
public once again the rules of Court, you cannot have 
cell phones or digital devices in the courtroom. We 
have not had an issue since the trial began and I just 
bring it to your attention . You have to keep them out 
of the courtroom. If I find that there's continuous 
violations of rules, The Court may have to increase the 
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procedures for searches and all of that before you come 
in here and I really don't want to do that. I just 
bring that to your attention. 



Are we ready to proceed? 

MAJOR FEIN: Yes, ma'am. 

MR. COOMBS: Yes, Your Honor. 

THE COURT: Major Fein? 

CAPTAIN OVERGAARD: Ma'am, defense 



witness is being recalled to continue his cross 
examination . 

THE COURT: So you're reopening your case; 
is that right? 

CAPTAIN OVERGAARD: Well, it's the defense 
case technically made it . Okay . 



THE COURT: 



Go ahead . 



EXAMINATION BY CAPTAIN OVERGAARD: 



BY CAPTAIN OVERGAARD: 



Q 



Chief Ehresman, I just remind you that 



you're still under oath. 



A 



Yes , ma ' am . 



Q 



You last testified on 8 July 2010 and at 
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that time you testified that you arrived in Iraq in 
November of 2009; is that correct? 
A Yes, ma'am. 

Q And then that was later in the 2010 because 

you had surgery? 

A Yes , ma ' am . 

Q So you didn't have the opportunity to do 

the right seat left seat? 
A Yes, ma'am. 

Q And you got the lay of the land when you 

got in theater by basically talking to other soldiers 
who were working around you? 

A Yes , ma ' am . 

Q When you got in theater you discovered that 

there was a program that you needed to run on your 
computer to do your job; is that correct? 

A Yes, ma'am. 

Q And you didn ' t have that program on your 

computer? 

A That ' s correct . 

Q Was that a media player? 
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A Yes . 

Q And everyone else in the S2 shop already 

had the media player installed on their machine? 
A Yes . 

Q So someone from the S2 stop give you that 

media player on a disk? 
A Yes, ma'am. 

Q Ands you tried to install the media player 

but you weren't allowed to do so? 
A Yes, ma'am. 

Q Ands you explained that administrator 

privileges came up when you tried to do that? 
A Yes , ma ' am . 

Q And then someone in the S2 told you that 

you could run the program on a disk? 
A Yes , ma ' am . 

Q And just you couldn't install anything? 

A Correct , ma ' am . 

Q So did this person then show you how you 

can run this program from a disk? 
A Yes , ma ' am . 
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Q And then after that did you go to Mr . 

Millman and ask him to install that program on your 
computer? 

A Yes , ma ' am . 

Q And he had to go and check ands make sure 

that he could actually installment the program on your 
computer? 

A Yes, ma'am. 

Q And he said he would get back to you? 

A Yes, ma'am. 

Q So in the meantime you ran that media 

program from the disk? 

A Yes , ma ' am . 

Q And you had a shortcut to your CD player? 

A Yes, ma'am. 

Q Because it was faster than clicking through 

everything on your desktop? 
A Yes , ma ' am . 

Q So then a few days later Mr . Millman came 

back to you and installed the media player on your 
program or D6A computer? 
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A Yes , ma ' am . 

Q And after that you did not have to access 

any programs from disks? 

A That ' s correct , ma ' am . 

Q Because everything you needed was already 

on your computer? 
A Yes . 

Q And you testified that even mIRC Chat was 

on your computer when you got there? 
A Yes, ma'am. 

Q You don ' t remember anyone else running any 

programs from disks? 

A No , ma ' am . 

Q Did this all happen soon after you arrived 

at FOB Hammer? 

A Yes , ma ' am . 

Q And that was November 2009 time period? 

A Correct . 

Q When you spoke to Mr . Millman about the 

media player he told you that you were weren ' t allowed 
to adds programs to D6A machines because they didn't 
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belong to 210; is that correct? 
A Yes , ma ' am . 

Q And he told you only he could authorize 

anything on the D6A machines? 
A That ' s correct . 

Q He actually told you he didn't want you 

saving files on your desktop? 
A Yes, ma'am. 

Q When you testified before on 8 July you 

said that Mr. Millman told you you could run 
executables on a CD . Do you actually remember Mr . 
Millman telling you that? 

A No , ma ' am . 

Q In fact, no one ever said anything about 

executable until in Mr. Coombs explained to you what an 
executable was a couple of months ago you didn't know 
what that term meant? 

A Yes , ma ' am . 

Q But you remember hearing that you were able 

to run anything from a desktop from someone in the S2 
shop? 
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A Yes , ma ' am . 

Q And you assume when you last testify it was 

Mr. Millman because you went to Mr. Millman with all of 
your D6A questions and issues? 

A Yes , ma ' am . 

Q But you don't remember who actually told 

you, if anyone, that you could actually run programs 
from that CD? 

A Yes . 

Q Actually someone in that unit that set that 

up for you? 

A Yes , ma ' am . 

Q And just to clear up an confusion from your 

testimony as well, you last testified you said that it 
was VLC on the CD? 

A Yes , ma ' am . 

Q But you're not actually sure that was VLC? 

THE COURT: What is VLC? 

THE WITNESS: It's a type of media player, 

ma ' am . 

BY CAPTAIN OVERGAARD: 
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Q But you're not actually sure it was VLC? 

A No. 

Q But you know it was a media player? 

A Yes , ma ' am . 

Q So to summarize, you're sure that you 

cannot put anything on your D6A computer without going 
through Mr. Millman? 

A Yes, ma'am. 

Q Ands you remember someone in the S2 telling 

you that you could run anything off a desk, you just 
don't remember who that was? 

A Yes , ma ' am . 

Q Was there ever a time after you arrived 

that Mr. Millman pulled everyone in the shop aside just 
to ensure that they understood that no one was allowed 
to add anything to their D6A machines? 

A Yes . 

Q Do you remember when that was? 

A January February timeframe. 

Q When was this? Was this at a shift change? 

A Yes , ma ' am . 



Provided by Freedom of the Press Foundation 



1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 



UNOFFICIAL DRAFT - 7/18/13 Afternoon Session 



15 

Q So was everyone in the unit present at that 

time? 

A Everybody in the shop that was in country 

was at that shift change . 

Q Did that include PFC Manning? 

A Yes , ma ' am . 

CAPTAIN OVERGAARD: Thank you. 
CROSS EXAMINATION BY MR. COOMBS: 
BY MR. COOMBS: 
Q Chief Ehresman, let's talk what about you 

know . DO you know if anyone had mIRC Chat as an 
executable file on their desktop? 
A Yes, sir. 

Q Did you know in PFC Manning had mIRC Chat? 

A Yes, sir. 

Q So I guess that would be an example of 

somebody other than Milliman adding something to a D6A 
computer? 

A Yes, sir. 

Q When you were I guess honing in on the 

brigade a month later, you indicated that your 
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understanding was that you could add — you could run 
executable files from a CD; is that correct? 
A Yes, sir. 

Q Let ' s go ahead and go through what you know 

from the S2 side . Did anyone in the S2 section say 
that you could not run an executable file from a CD? 

A No, sir. 

Q Did anyone in the S2 section say that you 

could not put a shortcut on your desktop to run an 
executable file from a CD? 

A No, sir. 

Q Did anyone in the S2 section say that you 

could not put an executable file on the desktop and run 
it? 

A No, sir. 

Q With regards to Mr. Millman, when he pulled 

everyone in his group, did, he at that point, say you, 
can't put games and music and executable files on your 
desktop? 

A Yes, sir. 

Q So he specifically said he thought you 
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could not do that, you shouldn't be able to do that? 
A Yes, sir. 

Q And do you know if every soldier had music 

and games on their D6A machine? 
A Yes, sir. 

Q So I guess Milliman said it and soldiers 

didn't follow what Milliman said? 

A Or it was already on there . 

Q Fair enough . And with regards to Milliman 

he wasn't in the military? 
A No, sir. 

Q He was the civilian person contracted to 

work on the D6A machines? 

A He was one of them, yes, sir. 

Q And with regards to the military chain of 

what you could and could not do on D6A computer, it was 
the S2 and above that kind of controlled what you do? 

A Yes, sir. 

Q And did the S2 ever put out — and I know 

Mr. Millman had his little group together, but did the 
S2 Captain Lamb or his predecessor (INAUDIBLE) pull 
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everyone together and say no more games, music, movies 
executable files on you D6A machine? 

A Not until after Private Manning get in 

trouble . 

Q So after Manning got in trouble that ' s when 

the S2 actually put that out? 
A Yes, sir. 

Q And prior to that? 

A No, sir. 

REDIRECT EXAMINATION BY CAPTAIN OVERGAARD : 

BY CAPTAIN OVERGAARD: 
Q DID you ever see anyone put the music and 

games in the D6A machines? 
A No , ma ' am . 

Q You just assumed it was on the T— Drive 

already? 

A Yes , ma ' am . 

Q And, again, Mr. Millman told you that only 

he could authorize adding things to the D6A machines, 
correct? 

A Yes , ma ' am . 
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Q He didn't necessarily say I must do it? 

A Right . That ' s correct . 

Q And defense asked you again about 

executables, but you didn't know what they were, did 
you? 

A Not at that time. 

Q Or self -executables? 

A Yes, ma'am. 

Q Thank you. 

THE COURT: Go ahead. 
RECROSS EXAMINATION BY MR. COOMBS: 

BY MR. COOMBS: 
Q The term executable, is that you 

understand? 

A Yes . 

Q You understood that certain things could be 

double clicked and run from a CD or from a desktop, 
right? 

A Yes, sir. 

Q So that was knowledge you had you just 

didn't know about being called an executable? 
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A That ' s correct . 

MR . COOMBS : Thank you . 

THE COURT : Talk to me about the video 
players . Once again what happened when you first got 
into the country with the media player? 

THE WITNESS : The media player because 
there was various amounts of my media players and some 
play on some and some wouldn't play on others. If 
you're looking at a file or a movie sometimes you need 
a specific video player to watch that specific video. 

So I didn ' t have it on my computer . So 
it was given to me . So I used it until I got to Mr . 
Millman . 

THE COURT : You said it was given to you . 
How was it given to you? 

THE WITNESS: On a CD, ma'am. And after I 
had problems with it and I was tired of pull it out and 
putting in another one back and forth transitioning I 
went to Mr . Millman and he corrected it for me . 

THE COURT: So at the time you were using 
the media player when you subsequently found out from 
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Mr. Millman that you weren't supposed to use files or 
software from a CD. Did you know that when you were 
using the media player? 

THE WITNESS: No, ma'am. 

THE COURT : Were other soldiers in the SCIF 
also using things from CDs like the media player? 

THE WITNESS: I don't know. 

THE COURT: Any follow-up based on that? 

CAPTAIN OVERGAARD: Yes, ma'am. 
REDIRECT EXAMINATION BY CAPTAIN OVERGAARD: 

BY CAPTAIN OVERGAARD: 
Q You don ' t remember anybody else running 

programs from disks? 

A No , ma ' am . 

Q Everyone else in the shop besides you had 

the program you remember running from the disk already 
on their computer? 

A Yes , ma ' am . 

MR. COOMBS: Nothing, Your Honor. 
THE COURT : I have one other one . 
Could you take something from a NIPR 
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computer on a CD and put in it a SIPR or D6A. 
THE WITNESS: Yes, ma'am. 

THE COURT: Any follow-up based on that? 

MR . COOMBS : No , Your Honor . 

CAPTAIN OVERGAARD: No, ma'am. 

THE COURT: Temporarily or permanently 

excusable . 

MR. COOMBS: Temporary, Your Honor. 

THE COURT: You are excused. Pleased 
don't discuss your testimony or knowledge of the 
case with anyone other than counsel or the accused 
while the trial is still going on. 

MR. COOMBS: We would ask that Chief 
Ehresman stay for the day . The only reason depending 
upon what the government elicits in his rebut case. He 
may have information in surrebuttal . 

THE COURT: Any objection? 

MAJOR FEIN: To stay, no, Your Honor. 

THE COURT: So. 

CAPTAIN WHYTE: United States recalls 
Mr. Jason Milliman. 
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DIRECT EXAMINATION BY CAPTAIN WHITE: 
BY CAPTAIN WHYTE: 
Q Mr. Millman, just to remind, you're still 

under oath . 

A Yes, sir. 

Q Let ' s talk a little bit about the use of 

CDs on the D6A machines. What, if any, physical 
restrictions were in place that prevented a soldier 
from putting a file on a CD putting the CD into the D6A 
machine and then running the file — running the file 
from the CD? 

A No visible restrictions . 

Q Were soldiers authorized to put an 

unauthorized executable file on a CD, put that CD in 
the D6A machine and run the unauthorized executable 
file? 

A No. 

Q Why not? 

A Because it was unauthorized. 

Q How do soldiers know what was or was not 

author i zed? 
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A They could come to me. If I didn't know 

the answer I would he seek guidance whether it was 
authorized or not. 

Q What, if any, physical restrictions were in 

place to prevent a soldier from putting a file on a CD, 
putting a CD into the computer, creating a shortcut on 
the desktop and then running the file? 

A Still no limitations . 

Q Were soldiers authorized? 

THE COURT: I'm sorry? 
THE WITNESS: Still no physical 

limitations . 

BY CAPTAIN WHYTE: 

Q Were soldiers authorized to put an 

unauthorized executable file on a CD or to put the CD 
in the D6A machine to create the shortcut and run the 
unauthorized executable file from the shortcut? 

A No, they were not authorized to do that. 

Q Would you have authorized someone to 

introduce anything from a CD on to the D6A machine that 
was unauthorized? 
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A No. 

Q What about using a CD for an authorized 

executable file, was that something like mlRC Chat, for 
instance, would that have been prohibited? 

A I don ' t know if it would be prohibited, but 

it would have been unnecessary because if it were 
authorized and they needed it I would have loaded it. 

Q So it wasn ' t common for soldiers to use a 

CD to load an executable file? 

A Correct . 

Q Because that would already have been on a 

computer? 

MR . COOMBS : Leading . 

THE COURT: I think he just paraphrased 
what the witness said. 

CAPTAIN WHYTE : No more questions . 
THE COURT: Cross? 
MR. COOMBS: Yes, Your Honor. 
CROSS EXAMINATION BY MR. COOMBS: 
BY MR. COOMBS: 
Q Mr. Millman, did you know whether or not 
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WGet was part of the baseline package for D6A 
computers? 

A I don't. 

Q At the time of the deployment did you know 

whether WGet was part of the baseline package? 

A If it were a part of baseline package then 

four years ago I probably would have known, but I don't 
recall that . 

Q Do you recall testifying that you didn't 

know whether it was part of the baseline package? 

A Correct . 

Q And in fact at article 32 you testified 

that you tried to determine whether WGet was part of 
the baseline package by calling the company that you 
worked for? 

A Yes . 

CAPTAIN WHYTE: Just beyond the scope of 

redirect . 

MR. COOMBS: They called this man to 
testify about executable files and WGet is an 
executable . 
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THE COURT: Go ahead. 
BY MR. COOMBS: 
Q Do you recall after the 32 testifying that 

you called the company to try to determine whether or 
not WGet was part of the baseline package? 
A Yes . 

Q And they told you basically they wouldn't 

give you that information? 
A Correct . 

Q Now, with regards to installing software. 

If you wanted to install a program on the D6A machine, 
you had to have admin privileges, correct? 

A For programs like mIRC Chat, no. For 

programs like (INAUDIBLE) that made changes to system 
operating system files then you would not (INAUDIBLE) . 

Q So your testimony is that you could add 

mIRC Chat as a program to the entire computer without 
admin privileges . 

A I think we've already established mIRC Chat 

was one of those type of executable files that could 
run by itself. 
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Q But my question is : If you wanted to add a 

program to the entire computer you needed to have admin 
privileges, correct? 

A I guess the problem I have with that 

question is you say, to the entire computer. It is 
either written on the computer or it isn't (INAUDIBLE) . 

Q If you had a program and wanted every user 

to log on to that computer to have use of it you had to 
have admin privileges to put it on the computer in that 
matter? 

A I believe so, yes. 

Q And that would be correct, you would be the 

one that as admin privileges? 
A Correct . 

Q And you talk about mIRC Chat you said 

admonishing what you wouldn ' t need to use an executable 
file because you're going to add it to the computer, 
right? 

A It wouldn't be necessarily on a regular 

basis because if it was something that the unit needed 
to use a regular basis it would have been identified, 
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and I would install it . The only exception to that 
policy is if — I had several camps to take care of 
between (INAUDIBLE) . 

So if I was on the other side of the 
country and someone for some reason mIRC Chat died and 
needed to be reinstalled I would probably authorized 
them to reinstall fro it their shared drive without me 
being there . 

Q When you install stuff you install it to 

the program where any user can log on that to computer, 
it was one of the programs they could use? 

A Correct . 

Q You didn't install stuff as executable 

files on the computer? 
A Correct . 

Q When you installed mIRC Chat installed, a 

version of mIRC Chat that was approved? 
A Correct . 

Q Because not every version was approved? 

A I don ' t think that — I don ' t know what 

version was or was not authorized. 
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Q But do you know that software that is 

approved is approved for a particular version because 
we want to make sure it plays nice with everything else 
on the did D6A? 

A Correct . 

Q So in mlRC Chat had version 11 that was 

approved and two months later version 12 come out . 
Version 12 is not authorized on the D6A computer, 
right? 

A In theory it would have been until it had 

already been vetted by the folks at (INAUDIBLE) and 
giving a verbal okay. 

Q The answer would be no? 

A Correct . 

Q When your relying on somebody adding mlRC 

Chat as a desktop executable, when the computer already 
has it, what does that tell you? 

A I'm not sure I follow. 

Q Well, does it tell you they're probably 

adding a newer version of mlRC Chat? 

A I don ' t think they would have added another 
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version of mlRC Chat if they already had a version on 
there to use. 

Q That's why I asked the question. If they 

already had a mlRC Chat on there to use and now they ' re 
adding something as an executable file as mlRC Chat, 
would that tell you that might be adding a newer 
version of it? 

A I suppose is not outside of the realm of 

possibly, but this is a leading what if. 

Q That's exactly what it is? 

A Because I don ' t know that ever happened so 

I can't testify to that. 

Q What I'm asking you is your expertise in 

computers . If somebody has a particular version of a 
program on their computer and then they add another 
version as a desktop executable that would be an 
instance where it might be a newer version? 

A Or it could have been an older version . In 

some cases some of the anti— virus software didn't work 
nice with newer versions versus older versions. It 
could have been a older version. 
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Q Let ' s deal with your experience . You said 

in your experience you were aware of certain officers 
who always want to have the latest version? 

A Not always, no. There was a few in the 

beginning, but there wasn't a frequent occurrence, no. 

Q Well, then the few in the beginning there 

are instances where somebody wanted a newer version of 
a program, right? 

A I don ' t know it was a newer version of a 

program, but it was a program that was not already on 
the baseline from D6A. 

Q And they wanted to add certain things and 

that's when you would say, no, you can't do that? 

A Correct . 

Q And one of those I believe involved a 

soldier that — well, actually before I get there with 
regards to executable files on the desktop, the 
government talked to another witness about a meeting 
that you had where you called everyone in and you told 
them what they could and could not do in January 
February time frame. Do you recall that? 
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A I don't recall a specifically meeting in 

January, a specific time frame, but I know during the 
repcoa, the changeover from one to the other when the 
new unit came in I made myself available to both shifts 
and they had shift change . So it was the prior unit 
incoming unit both day and night shift . 

So there were literally 75 to a hundred 
people in the room where we went over this D6A system, 
this is your D6A support guy. They pointed to me. Any 
questions you go to him. You can and can't do this so 
and so forth . 

Q When you say repcoa rep co-that when you 

recall doing this? 

A I also did it when I — the new unit comes 

in the (INAUDIBLE) goes to the men which I went put the 
unit on the machine . I talked with the users at that 
station and let them know the same thing. 

Q I'm just talking about a meeting where you 

would have had both the day and night shift, you know, 
the 75 or so people you just testified about, one area 
you say what you can and can't do? 
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A Correct . 

Q When do you recall doing that? 

A It was shortly after the unit got there. 

Q When was that? 

A I think it was like October November time 

frame. I don't remember when they actually got there. 

Q And so when you recall doing that, what 

precipitated you to do that? 

A Commons ens e . I mean, they needed to know 

what was there and what they were authorized to do and 
not to do . 

Q Now, with regards to seeing you said — you 

testified earlier that you saw games and music and 
stuff on the D6A computer, right? 

A I saw music and I had seen games on the D6A 

laptops . I know there were games on shared drives of 
places, but I never saw games on the D6A laptop. 

Q We'll stick can with what you remember 

music? 

A Yes . 

Q And my understanding is music then in this 
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big meeting you wouldn't allow music on the D6A 
machine, right? 

A I didn't like it, but I had no authority to 

tell them to take it off. It was — the computers 
belong to the unit specifically as far as ownership. 
What they wanted to use the computer of was outside of 
my authority . I worked for the unit . I could tell 
them what the project authorized and didn't authorize 
and if they violated those terms in theory they would 
violate their warrantee and support for this project. 

Q So if I understand you correctly then if 

you saw music you could say I don't know like that, but 
I can't force you to take it off? 

A Correct . 

Q If you saw executable files that they're 

not part of the baseline package, was that true for 
that as well where you could say I don't like it, but I 
can't make take it off? 

A The determining factor was that if the 

programs loaded on to laptop that were not part of the 
D6A baseline, if they were unknown to work or not we 
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could try it out . If it interfered with the system 
software say RJIS programs (INAUDIBLE) if it damaged 
those programs ability to operate then they had to come 
out. If it didn't, we would allow. If it was very 
very rare that that came up . 

So the end result was if they had something 
that was part of the baseline but it was allowed 
authorized, it was okay. I mean, whether I liked it or 
not . 

Q I just want to make sure I understand it . 

If I'm an intel analyst and I'm working in the shop and 
you come up to me and I say, I've got this executable 
file that I like, it's not part of the baseline 
package, I like it. It helps me do my job or, you 
know, I think it's a good executable, I put it on my 
desktop . You see me do that , you ' re not happy with 
that but I say it plays nice with all of the other 
programs, can you make me take it off? 

A Yes . In that case yes because there was no 

prior coordination to see if it was allowed to be put 
on. If that happened my direction was to immediately 
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take the machine . If I were would notice that 
happening my initial is to take the machine. 

Q Music, why was it the same reaction? 

A Because that ' s not a program that make 

changes to system files and so on. 

Q So in your mind there was a difference 

between music, how about games? 

A Games would have been treated the same way 

as far as reusing the machine . 

Q In you saw games on a D6A machine and you 

tell them to take it off and if they didn't you would 
say I want the machine? 

A I would notify the NCO in charge of that 

person. If it wasn't an NCO knock then would have the 
next supervisor was and contact and let (INAUDIBLE) it 
would be taken almost immediately . 

Q Did you ever do that? 

A I don't recall any instance of that needing 

to be done . 

Q So you don ' t recall any instances where you 

saw somebody with games on their D6A machine? 
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A Correct . 

Q Were you looking for that? 

A I wasn ' t going to each person every day to 

see if they had games on their machine, but when I went 
to their machines to do updates if he had problems I 
would see what that had on the machine because I would 
need to check out their portfolio . If the machine had 
crashed would you look on their portfolio and see what 
data they and ask them what they wanted me to save. If 
they had something like games I would have seen it . 

Q And you don't recall ever seeing that? 

A No. 

Q Would it surprise you that games were on 

analysts computers? 

A No, knowing human nature it wouldn't 

surprise me at all . 

Q It wouldn't surprise you, but you didn't 

see it at all the time you were there? 

A I didn't see it. 

Q You did report an incident that involved XP 

Lite, L-I-T-E? 
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A That name sounds familiar. I'm not sure I 

mentioned a program to prosecuting attorneys. I don't 
know what the name was, but there was some program they 
liked that would condense PowerPoint programs . 
PowerPoint (INAUDIBLE) But I don't remember the name 
specifically . 

Q Do you remember ever going essentially to 

the S6 because they added that program to the D6A 
machine over your authorization? 

A There was a program I think I mentioned 

this that they loaded to install . That may have been 
that software, but I don't recall the name of the 
software . 

Q And when you took that to the S6 what 

happened after you say hey you cracked my password you 
added this program, what happened after that? 

A I had to take the machine because one of 

things they took was to delete administrator account 
from the machine which is a required account for me to 
do my job. So I had to reimagine the machine, 
reinstalled the account and put those back the way they 
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were before S6 got a hold of it. 

Q Now, with regards to executable programs 

they can be from a CD; is that right? 

A Yes . 

Q And they can be run if you take the 

contends of a CD and you put on the desktop then you 
can run an executable from the desktop; is that 
correct? 

A Yes, sir. 

Q And if you want to keep it on the CD and 

you want to create a shortcut you can create a shortcut 
on your desktop to run it from the CD? 

A Yes, sir. 

Q Those are the three ways that essentially 

an executable program can be run? 
A Correct . 

Q With regards to executables, when you had 

that meeting of, you know, what you could and could not 
do, do you recall referencing executable files? 

A No, I don't. 

MR . COOMBS : Thank you . 
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THE COURT: Does that mean you don't recall 
or you didn ' t reference them? 

THE WITNESS: I don't recall referencing 
them anything further from the government . 

CAPTAIN WHYTE: Nothing further, ma'am. 

THE COURT : Could games be run from CDs . 

THE WITNESS: I suppose they could, ma'am. 

THE COURT: If they were would you see them 
when you looked at the machine . 

THE WITNESS : No if they were contained on 
the CD they put a music CD in their then came to the 
machine I couldn't tell you they played it. 

THE COURT: If there were shortcuts for CD 
programs or games on the a machine when you were on the 
machine to fix problems would you see the shortcut? 

THE WITNESS : I would see a shortcut . If 
they needed work and it was their games all I would see 
is a shortcut that said work. 

THE COURT: Are music CDs executable files? 

THE WITNESS: I don't really know the 
answer to that, ma'am. A general sense I would say not 
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really no . 

THE COURT: How about movies? 

THE WITNESS: I would say, yes, probably. 

THE COURT: Any follow-up based on that? 

CAPTAIN WHYTE: One second. 

THE COURT : While the government is 
conversing I have one final question. 

Movies are executable files . Were music 
or executable file files do they require a media 
player to play them? 

THE WITNESS: Movies definitely would, I 
guess, depending on the music, yes, they would both 
require a media player . 

THE COURT: Were media players authorized 
for the D6A computers? 

THE WITNESS : I know there was a version of 
media player while I was at Camp Solara . Normally D6A 
laptops use BLC . I don't remember FOB Hammer D6A based 
on it had Windows media players other the VLC or both 
or neither. I'm 99 percent sure there was a media 
player because I know that the had analysts had to have 
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the ability to analyze and review videos and audio 
clips . So I don ' t remember which media player they but 
I know they had something . 

THE COURT: If the D6A computer had a media 
player that could play music and movies why would they 
prohibit it on the D6A computer? 

THE WITNESS: I'm not sure. 

THE COURT: Maybe I misunderstand. I 
thought that the testimony earlier was that you 
couldn't have music or games — games, I don't remember 
a media player. 

THE WITNESS: No, I don't think so. I 
guess it's kind of a gray area, at least to me. I 
guess I'm not as in tune as some of the other co— called 
experts, but for music and movies I guess they are an 
executable for them to run, but I think what we are 
referring to executable here, we're talking about a 
self —contained program that performs some sort of 
either data manipulation or editing of files . 

So since a music file doesn't perform 
data manipulation or edit a file to view it as a 
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movie, I don't think it's classified as (INAUDIBLE) 
like mlRC Chat . That will support say chat history 
so you can go back and look at stuff. In that 
instance I think mlRC Chat is an executable, but I 
wouldn't classify movies or music of that type of 
executable if that makes sense . 

THE COURT: Any follow-up based on that? 

CAPTAIN WHYTE: No, ma'am. 

THE COURT : I'll ask you one more . What 
was the purpose of not allowing music and movies? 

THE WITNESS: Once again, the music and 
movies stuff we couldn't disallow. That would void the 
service contract because once again it doesn ' t create 
any database manipulation or editing of files so it 
wouldn't interfere with D6A other programs, but other 
programs that were on so-called executable that would 
make file changes, some system file changes, those type 
of executables had to be vetted through Camp 
(INAUDIBLE) for authorization to put on the machine 
because if they interfered with those mission essential 
programs they couldn ' t be on the machine . 
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THE COURT : Could games interfere with 
those programs? 

THE WITNESS : I think games would because 
games store information and use system files . 

THE COURT : My understanding of your 
testimony to be that music and movies were not in 
violation of D6A computer rules but games were? 

THE WITNESS : I believe that to be correct . 
Again, it's wasn't like it wasn't preferred it wasn't 
condoned, but when it got right to the brass tacks the 
company I work agree to . We work for the military . It 
was up to the command to decide what they would or 
would not allow on a machine as long as it didn ' t 
interfere with the mission. 

So while we may not have liked whether 
they played music or movie we couldn't prohibit them 
from playing movies or music. 

THE COURT : Any follow-up based on that . 

CAPTAIN WHYTE: Just a few, ma'am. 
REDIRECT EXAMINATION BY CAPTAIN WHYTE: 

BY CAPTAIN WHYTE: 
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Q Mr. Millman, was the T— Drive unique to the 

D6A machines? 

A No . The T— drive was the unit ' s shared 

drive . 

Q So people that were not on D6A machine 

could put information on the T— drive? 
A Correct . 

Q Did a soldier ever ask you to put on WGet? 

A I don't recall any soldier asking me that. 

Q Have you heard of WGet? 

A I don't recall hearing that until this came 

about . 

CAPTAIN WHYTE: Nothing further, Your 

Honor . 

THE COURT: Defense? 

MR. COOMBS: Nothing, ma'am. 

THE COURT : Temporary or permanent . 

CAPTAIN WHYTE: Temporary. 

THE COURT: Mr. Millman, you are 
temporarily excused. Please don't discuss your 
testimony or knowledge of the case with anyone other 
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than counsel or the accused while the trial is going 
on . 

THE WITNESS: Yes, ma'am. 

MAJOR FEIN: United States calls Special 
Agent Shaver . 

MR. TOOMAN: Before the witness comes out, 
the defense would like to address an issue with the 
Court . 

THE COURT: Go ahead. 

MR. TOOMAN: Your Honor, one of the 
rationales provided by the government, I'll just read 
it verbatim so I don't miss represent anything here. 
United States will recall Special Agent Shaver to 
discuss how WGet is run from the accused profile on his 
SIPRnet computer's counter system. The testimony of 
CW2 Esherman that an executable file can be run off of 
a disk. 

It ' s defenses position that Chief 
Ehresman never testified about WGet or how it was 
run by the excused. We believe the testimony was 
questioned by Major Fein do you know what WGet is, 
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no, you don't know what WGet is? I don't. So you 
don't know he, assuming my client here, was good or 
bad at using WGet? No, sir. 

Was WGet, to the best of your memory, 
one of those D6A tools that the Army provided to 
intel? I don't know what WGet it is. 

It's defense's position that he never 
testified about WGet. To the extent that Chief 
Ehresman talked about executable files and how 
they're run. He's been consistent on that. He said 
there were a couple of ways you could to do it . You 
can run it off of disk. You can take it from a disk 
and put on it to your portfolio . 

It defense's position Special Agent 
Shaver will say to you the same thing as Mr. 
Millman. When you have a executable file you can 
run it from the CD, you can take it off of a CD and 
put it onto your desktop or your user profile and 
those are the only ways you can run it . 

A third was referenced where you create 
a shortcut . That essentially still running it off 
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the CD. That's what Special Agent Shaver will say 
as well. As far as the government wanting to talk 
about WGet, we don't feel it's proper rebuttal, 
Chief Ehresman didn ' t talk about it . He said I 
don ' t know what it is . 

Special Agent Shaver isn ' t going to to 
rebut anything Chief Ehresman said because he ' 11 say 
they were — echo what Chief Ehresman said and what 
Mr. Millman said here today. 

MAJOR FEIN: May I have a moment, Your 

Honor? 

CAPTAIN OVERGAARD : Ma ' am, the government ' s 
filing and litigated yesterday, the United States is 
recalling Special Agent Shaver (INAUDIBLE) was run from 
the accused profile on a SIPRnet computer. The 
testimony of Chief Ehresman was executable files in 
general that could be run off the desk. So there's 
been some confusion about how. 

THE COURT: Now, well you're recalling 
Special Agent Shaver to talk about where WGet was 
forensically on PFC Manning's computer; is that 
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correct? 



CAPTAIN OVERGAARD: 



How it was run 



forensically on his computer. 



THE COURT: 



Chief Ehresman testified about 



where . 



CAPTAIN OVERGAARD: 



He testified about how 



executable files could be run off of a disk. So the 
government believes that on the D6A computer and a 
Chief Ehresman and Mr. Millman are not computer 
experts. They haven't been called as computer experts. 
The government believes that someone is necessary to 
come in and explain to the court how this program was 
run and how it was run in this case and how executables 
files are run because Chief Ehresman said he wasn't 
sure it was executable . Mr . Millman said I think it 
was , but he wasn ' t sure either and he ' s not a computer 
expert . 



allow it because I'm a little bit confused as the fact 
finder and I can also ask for witness here RCM913CF. 
So I'm going to allow Special Agent Shaver to testify. 



THE COURT: Captain Tooman, I'm going to 
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MR. TOOMAN : I guess we would just say that 
certainly Agent Shaver could rebut the testimony of 
Chief Ehresman as about how executable files run, but 
there ' s nothing to rebut with respect to how WGet was 
run by PFC Manning. The defense has put on no evidence 
about that . 

THE COURT: I'm going to allow it any way 
because I'm confused on that issue and I think this 
witness can provide some clarity. 

Go ahead . 

MAJOR FEIN: United States recalls special 
Agent David Shaver. 

DIRECT EXAMINATION BY MAJOR FEIN: 
BY MAJOR FEIN: 
Q Please take a seat, Special Agent Shaver, 

as I remind you you're still under oath. 
A Yes, sir. 

Q I'm going to grab some exhibits before we 

proceed . 

THE COURT: They've all been marked. 
MAJOR FEIN: They have, Your Honor. 
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MR. TOOMAN: We object. We believe that 
the government is going use some sort of PowerPoint and 
we have not been provided that in advance . 

THE COURT : Has it been seen it . 

MAJOR FEIN: No, ma'am. It's a 
demonstrative exhibit that we're going to lay a 
foundation like the defense did with Mr. Hall that he 
created himself and he ' s going to go through it and we 
can take a recess and give them a copy. 

MR. TOOMAN: If I could just take a quick 
look at it. Ma'am, if we can take a recess and make a 
copy of this? 

THE COURT : How much time would you 

like? 

MR. TOOMAN: 10 minutes. 

THE COURT: Any objection to that? 

MAJOR FEIN: No, ma'am. 

(Hearing recessed at 3:15 p.m.) 

(Hearing resumed at 3:40 p.m.) 
THE COURT: I just held a RCM802 
certification with counsel prior to coming in and 
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Captain Tooman advised me that the defense had several 
objections to the upcoming testimony. 

Did we need to excuse the witness while 
we present them for the record? 

MR. TOOMAN: I don't think so, Your Honor. 

THE COURT: Please go ahead. 

MR. TOOMAN: Your Honor, Agent Shaver and 
how WGet specifically is run. We understand the Court 
seeks clarification as to how WGet actually got on PFC 
Manning's computer, but we don't believe that would be 
proper to get into how WGet runs once it ' s on PFC 
Manning computer because we didn't elicit any testimony 
to that during our case in chief. 

We would also object to the forth slide 
which is a command prompts which includes PFC 
Manning. Our objection there is this isn't a 
command prompt that was found forensically so it 
would be confusion as to whether or not this is 
actual evidence of what PFC Manning did and it ' s not 
evidence to what PFC Manning may have done . So we 
would just ask that it his not be used with respect 
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to this evidence . 

THE COURT : Government ? 

MAJOR FEIN: Ma'am, for the first point 
the, United States originally based on Chief Ehresman 
was there was a interference that program WGet or 
another could be run on a CD and to truly understand 
whether that is what happened in this case under these 
circumstances where the program was run, it's best for 
the Court to try to understand how WGet works for 
Special Agent Shaver I guess opinion really on whether 
that is what occurred or not . 

The second point is the forth slide the 
United States discuss not — this whole slide shows 
demonstrative overall, especially Agent Shaver 
created every piece of this slide show including 
that command prompt and in the actual direct the 
United States intends to elicit that he is not 
saying this is actually what PFC Manning had on his 
computer, but he replicated it in order to aid him 
in his testimony. 

THE COURT : Yes . 
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CAPTAIN TOOMAN: Your Honor, to clarify 
Chief Ehresman, he did testify that an executable 
could be run a CD, but he also testified that an 
executable can be run by taking that off file, the 
CD, and place it on the user portfolio and running 
from it there . 

So we don ' t believe we put forward any 
evidence that PFC Manning did it one way or the 
other . These are the ways it happened and we 
believe that Agent Shaver would echo that at the 
ways that it happened the same in rebut . 

THE COURT: All right. Well, I've already 
ruled on this earlier and I'm going adhere to my 
original ruling. I am going to allow this in and I 
certainly understand this is a demonstrative exhibit 
and I certainty won ' t use for it anything else . 

Go ahead . 

MAJOR FEIN: Yes, ma'am. 
BY MAJOR FEIN: 
Q Special Agent Shaver, again, you're under 

oath . 
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A Yes . 

Q In preparation for your testimony about 

WGet and how it works and where it was found on PFC 
Manning's computer did you prepare a demonstrative 
exhibit during your testimony? 

A Yes. 

MAJOR FEIN: Your Honor, I'm handing 
Special Agent shaver Prosecution Exhibit 187 for 
identification . 

BY MAJOR FEIN: 

Q Could you look at this, please? 

A (Witness reviewing document . ) 

Q Do you recognize prosecution 187 for 

identification? 

A Yes, sir. 

Q How do you recognize it? 

A It is a PowerPoint presentation I created. 

Q When did you create this? 

A I completed it this morning. 

Q And did you create every aspect of this 

PowerPoint presentation? 
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A I did. 

Q I'm retrieving prosecution Exhibit 187 for 

identification, Your Honor. 

How many slides was does this exhibit 
contain, Special Agent Shaver? 

A Four . 

Q Special Agent Shaver what is WGet? 

A That is a command line tool to download 

files from a web server. 

Q What is a web server? 

A It is a computer running special software 

which allows it to host web pages . 
Q What is a web page? 

A That is a graphical interface to show to 

the use . 

THE COURT : I know going to ask you to ask 
all three of those questions again. This is so fast I 
can ' t even understand it . So go ahead . 

MAJOR FEIN: Yes, ma'am. 

BY MAJOR FEIN: 
Q Special Agent Shaver what was WGet? 
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A That is a command line tool that you 

download from a web server. 

THE COURT: Go ahead. 
BY MAJOR FEIN: 

Q What is I ' 11 ask you in a moment about what 

is a web server? 

A That is just a computer with a piece of 

software on it that allows it to host web pages . 

Q And what is a web page? 

A That is just a file that presents 

information to a user to be viewed over the Internet . 

Q When does the term file type, what does 

that describe on a computer? 

A Just what kind of file it is . 

Q And what is the common file type for a web 

page? 

A An HTML. 

Q What does HTML? 

A Hypertext markup language . 

Q Now, you've explained what a web server, 

web pages, what is a website? 
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A A website is hosted on a web server and it 

is a collection of web pages . 

Q And how does a website with web pages 

relate to a web server? 

A A web server hosts them and they are 

contained within . 

Q What do you mean by host? 

A It presents it to the users on the 

Internet . 

Q How does a file type relate — now, go to 

basically installed programs . What is an installed 
program? 

A It is a program which has been used as an 

installer. It's a program that places the file into 
the program files folder also generally puts an 
uninstaller so in case you need to remove the software . 

Q What is a program? 

A That is a file that interfaces with the 

operating system to do a task. 

Q And how do file types relate to installed 

programs on a computer? 
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A The file types are associated with 

installed programs. For example, a document at .doc is 
associated with the Microsoft product, Office Word. 

Q What type of file can you link to do a web 

page? 

A Any type of file. 

Q What does it mean to be linked to a web 

page? 

A Within the web page it ' s a redirect to a 

file somewhere else, whether it's locally on the same 
web server or some other part of the Internet . 

Q And what do you mean by redirect? 

A It is a URL location and you would click on 

it and you would then be brought to the next location. 

Q What is a URL? 

A Uniform Resource Locator . 

Q What does that provide a user or a web 

browser? 

A It ' s an address on the Internet . 

Q On the .22 and .40 on the D6A SIPRnet 

computers where programs were installed to allow all 
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users to view the contents of a web page. 

A Internet explorer . 

MR. TOOMAN: Objection. We think is 
outside the scope of rebuttal. If we want to talk 
about WGet that's one thing, but I think this is 
outside of what the Court has said is appropriate. 

THE COURT: Full automation program how 
programs get in on computers and things like that has 
been raised in this trial. So I'm going to allow it. 
Go ahead . 
BY MAJOR FEIN: 

Q Special Agent Shaver, on the .22 and .40 

SIPRnet computers what programs were installed to allow 
a user to view the contents of a web page? 

A Explorer and Firef ox . 

Q What type of programs are those? 

A Those are web browsers . 

Q What is the purpose of a web browser? 

A It ' s allows the user to view web pages . 

Q Now, you testified a moment ago about 

linked files on I web page. How would a user view a 
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linked file on a web page? 

A You would first open an Internet browser 

navigate to the web page, identify the link. They 
would like to go to and move the mouse and click on the 
link . 

Q What would happen once you click on that 

link? 

A It would — the link would open up . A link 

would open a new website or it would download a file. 

Q And when you said download a website, can 

the link be another web page? 

A It can . 

Q And when you click on the link that ' s 

another web page, what happens to that web page you're 
linked to? 

A You now go that web page . 

Q What does that mean? 

A That web page is presented to you within 

the web browser . 

Q Special Agent Shaver, does one of the 

slides cited help demonstrate what you just testified 
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about? 

A Yes . 

Q Which slide? 

A Slide number one. 

MAJOR FEIN: Your Honor, permission to 
publish slide number one? 

THE COURT : Yes . 
BY MAJOR FEIN: 

Q Special Agent Shaver, using this slide 

slide number one could you please explain to the Court 
exactly how a user would access a file name file name 
one dot PDF on a web server on a web page? 

A If you direct your attention to the lower 

left that would be the user ' s computer . They would 
open a web browser . They wrote navigate to the web 
page at the address . 

There is example I have given is 
www.website.sgov.gov. Government web page would be 
presented to the user. They would identify the link to 
file name one dot PDT . The user would click on it 
because he would then pass that command to the web 
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server to present that to the user . 

The web server would pull it from it 
various locations whether it ' s locally or somewhere 
else on the Internet . It would then be presented to 
the user in the web page . 

Q Special Agent Shaver, what is that dotted 

blue line with file name one dot PDF on this exhibit? 

A It depends . That is for if you click on a 

file and your website does not allow you to view web 
PDT files or allows you to save that locally. 

Q What do you mean by save it locally? 

A When you click on the link if the web page 

you're viewing does not allow you to view PDF files it 
will say would you like to save this file to your 
machine . 

Q What do you have to do when you ' re 

presented with that question? 

A You can either say yes or no . 

Q And with that example the PDF is that true 

for all other file types? 

A It could be, yes. 
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Q What about web pages? 

A Web pages are displayed within web browser . 

An executable would be served. 

Q So we'll get to execute in a moment, but 

for a web page if a user was to navigate in your 
example to website.sgov.gov to that web page. On that 
I think you have on webpageindex . HTML and they were to 
navigate there and click on another web page, what is 
the route that the web page takes to get to the user ' s 
computer? 

A Through the web browser . 

Q Is that the same web browser that you 

initially were navigating on? 

A Correct . 

Q Do you normally get a prompt that says do 

you want to the save or not? 

A Not for an HTML. 

Q And that is a web page? 

A Correct . 

Q Special Agent Shaver, earlier you testified 

that WGet was a program that allows you to copy files 
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to a web server. Now I'd like to ask you to specific 
question about WGet . 

I'm pulling off slide one of Prosecution 
Exhibit 187 . What does WGet allow users to do on a web 
server? 

A Download files. 

Q And where does it download to? 

A To the local machine . 

Q What do you mean by, local machine? 

A The person using WGet would generally save 

it to their local machine . 

Q When using WGet is the user required to 

navigate through the original web page that they would 
otherwise have to use when they open up Internet 
Explorer? 

A It depends on what files you want to copy. 

If you want to you can tell it to go to a web page 
identify all of the links and copy all of that down . 
If you just would like to download one file it would 
not go through that . 

Q And if you wanted to download a single file 
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why would it not go through the individual web page? 

A It doesn ' t need to . You would provide a 

direct URL to the file in question. 

Q And the user running WGet to obtain a file 

on a web server what happens? 

A The file would be downloaded to your local 

machine . 

Q From where? 

A From the web server . 

Q And does that target file then when it ' s 

downloading again pass through that original web page 
containing the link to the file? 

A No, sir. 

Q Special Agent Shaver, do one of the slides 

that you created help demonstrate what you just 
testified about? 

A Yes, sir. 

Q Which slide that? 

A Slide two. 

MAJOR FEIN: Your Honor, permission to 
publish slide two? 
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THE COURT: Go ahead. 

BY MAJOR FEIN: 
Q Special Agent Shaver, is this slide two? 

A Yes, sir. 

Q And could you please explain to the Court 

this demonstrative exhibit on how WGet downloads this 
file name do the PDF from a web server? 

A Yes, sir. Again in the lower left is the 

user. They use WGet. It goes to the website again 
website.sgov.gov. It downloads the file name by PDT 
and that is then saved locally on the machine . 

Q And when a user runs WGet and your example 

used a PDF that also what you just describe the same 
for a web page? 

A It depends on how you want to do it . You 

can say download a web page and it will . You can also 
tell it to go through a web page and only pick out 
certain files . WGet is a very configurable tool . 

MAJOR FEIN: I will removal slide two, Your 

Honor . 

BY MAJOR FEIN: 
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Q All the next few questions will be based on 

your knowledge of WGet on a computer regardless which 
is authorized or not to be installed or stored on 
computers. Just about the capabilities. 

Technically speaking how does a user 
introduce WGet onto there their Windows based computer? 

A They would go to a web browser, navigate to 

a web site that has the file WGet, download and save it 
to the desktop . 

Q So now the same question on a technical 

basis . How does — could one introduce WGet onto a 
SIPRnet computer? 

A User would open a web browser, search for 

WGet, download it to on the NIPRnet computer, put it on 
some kind of transport medium, a CD, for example, and 
then walk over to the SIPRnet and put the CD into the 
SIPRnet computer and copy the file from the CD on to 
their user portfolio. 

Q Where on a computer can WGet be run from? 

A Anyplace the user has access. 

Q And what did you mean by that? 
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A User accounts, there's Windows is 

permissions . There ' s certain places a user cannot 
access. For example, the Windows folder itself or 
other profiles on the computer. 

Q What do you mean by profiles? 

A User accounts, other people who have logged 

onto that computer. It would create a profile and that 
would be — a normal user could not access the files in 
those . 

Q Again technically speaking can WGet be run 

from a CD or DVD? 

A It could. 

Q Could it be run from a USB drive? 

A Yes . 

Q What about an SD card? 

A Yes . 

Q And shared drive? 

A Yes, sir. 

Q And is WGet a program that must be 

installed? 

A No. 
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Q Why? 

A It is a self-contained executable . 

Q What is a self-contained executable? 

A That is a program that does not need any 

other libraries or any other files run. It has 
everything it needs built into itself. 

Q When you say library, what do you mean? 

A When programming files on windows computers 

there are various libraries, one is a mouse library. 
It does not need that. It has all the components 
rolled into it . 

Q Is there a difference between a program and 

a executable? 

A They ' re synonymous . Same thing . 

Q And before we keep going, in your own 

words, what is a essentially a program or executable? 
Specifically how does it distinguish from another type 
of file? 

A It is a program. A program is a file that 

can interface with the operating system to execute a 
task . 
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Q Based on your experience with Windows 

computers is there any process or limitation that could 
be used to prevent a program for being installed on a 
computer? 

A Yes . 

Q What is that? 

A It would be administrator level privileges 

to install a program. 

Q Based on your experience of Windows XP 

computers is there any process or limitation that could 
used to prevent a self —executable file from being 
installed on a computer? 

A A self-deaned executable is not a file that 

can be installed. It's a single file. 

Q How is it that a — how does a 

self-executable get moved to a computer to run it if 
it ' s not installed? 

A You copy it from the source? 

Q Copy it over? 

A To the user account . 

Q So then in your experience is there a way 
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that Windows XP computers prevent the user from copying 
over self —executable files onto a computer from an 
external drive? 

A No, sir. 

Q Based on your experience of Windows XP 

computers is there any process or limitation to prevent 
a self —executable file from being run on a computer or 
any other storage device? 

A Sorry, sir, would you repeat that question? 

Q Based on your experience with Windows XP 

computers, is there any process or limitation that 
would be used to prevent a self —executable file from 
being run on a computer or an external media device? 

A There ' s a HBSS host base security system 

which is a Department of Defense program which has a 
lot of policies. It can prevent a file like that from 
being run . 

Q And so specifically can this HBSS prevent a 

self —executable run on a computer or from its 
prevalence? 

A Yes . 
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Q During your examination of document .22 .40 

what operating system was installed? 
A Windows XP . 

Q And was HBSS installed on those computers? 

A No, sir. 

Q To the best of your knowledge, when you 

were still in the Department of Defense, did the 
Department of Defense use HBSS technology on SIPRnet in 
2009/2010? 

THE COURT: HBSS or HBSS? 
THE WITNESS: B. 
BY MAJOR FEIN: 
Q What does that stand for . 

A Host Based Security System. 

Q From your examination of the .22 and .40 

computers, was there any computer technological 
limitation from running a self —contained file from the 
hard drive or peripheral? 
A No. 

Q So based on your exam of PFC Manning ' s 

SIPRnet computers, what was the only way a user could 
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be prevented from either copying a self —contained 
executable over or running one from a CD? 

A Policy was one . To remove it from the CD 

was to prevent it from being copied from a CD would be 
to remove the CD . 

Q I'm sorry? 

A The technical notation would be to remove a 

CD player from the computer so you cannot copy it off. 
Remove USB ports, but that's it for technology. 

Q So just to make sure the Court understands . 

You're saying remove the actual physical CD ROM from 
out of the computer? 

A Right . 

Q In your experience of PFC Manning .22 and 

.40 computers did you find any evidence of WGet being 
run? 

A I did. 

Q Where did you find that evidence? 

A From the prefetch file. 

Q What are prefetch files? 

A This is a Windows program that is a Windows 
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system file that ' s created to help Windows start 
programs faster the next time you use them. 

Q How does Microsoft Windows use the prefetch 

file? 

A When a programs is first run, a prefetch 

file is created. It contains some information, some of 
the memory, some of the file is kept there. So when 
you double click the program a second time it's 
injected into the RAM faster. So this is a Windows 
idea to speed up launching of programs . 

Q And could you give the Court an example, 

use Microsoft Outlook as an example of how Windows 
would use these prefetch when you run Microsoft 
Outlook? 

A The first time you launch Outlook a 

prefetch file would be created. It would capture the 
path of where it was run from and against the time 
prefetch file would be created, but it would capture a 
part of the program in RAM. So when you terminate 
Outlook and you launch it for the second time it would 
launch faster, it would start faster. 



Provided by Freedom of the Press Foundation 



1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 



UNOFFICIAL DRAFT - 7/18/13 Afternoon Session 



77 

Q Special Agent Shaver, what is actually 

contained within the prefetch files for each program? 

A The path of the executable, the time and 

date, the date last run, the date it was created, how 
many times it had run. 

Q What do you mean by the path of the 

executable? 

A Where it was physically located on the 

computer . 

Q Is that similar to a URL? 

A Yes . 

Q And how is it similar? 

A It is just a location, but it would be a 

location on the local machine . 

Q Why is the path captured within the 

prefetch file? 

A It ' s a Microsoft decision to do that, but 

it allows you to, if you have multiple instances of the 
same program each, program has a prefetch file. So 
they can all launch faster the next time. 

Q What do you mean by multiple instances of a 
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program? 

A Say if you have several copies of your 

Outlook, if you had Outlook located on several 
locations on the computer that can run they would 
launch faster the second time. 

Q So what happens to the prefetch file a 

program is run from a different location on the same 
user ' s computer? 

A A new prefetch file could be created. 

Q Special Agent Shaver, I'm handing you 

what's been marked as Prosecution Exhibit 188 for 
identification. Would you take a look at that. Do you 
recognize that document? 

A Yes . 

Q What is it? 

A This is a document I cited. 

Q What is the actual document? 

A The document is the — it ' s a listing of 

prefetch files from the .22 computer which were created 
by the WGet EXE program. 

Q And how do you recognize that? 
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A I created this . 

Q Thank you. 

THE COURT: What exhibit is it? 
MAJOR FEIN: Your Honor, Prosecution 
Exhibit 188 for identification. Permission to public, 
Your Honor . 

THE COURT : Yes . Has that is exhibit been 
admitted yet? 

MAJOR FEIN: No, it has not, Your Honor. 
For identification. 

BY MAJOR FEIN: 
Q Starting at the top, Special Agent Shaver, 

could you please explain or orient the Court on what is 
listed across the top for this exhibit? 

A The top is the file I made, the prefetch 

files for WGet (INAUDIBLE) from .22. 
Q Did you add that title? 

A I did. 

Q What is the first column? 

A The first column is a line number. The 

next column is the prefetch file name and that ' s also 
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has the path, the date that the prefetch file was 
created, the date the last that prefetch was last run, 
the next column is the program which created that 
prefetch file. 

Q I'll move this for you. 

A Thank you . And the last is the path 

contained within the prefetch file of where that WGet 
program was run from. 

Q So you've now mentioned just before we get 

into the information contained within the exhibit, you 
mentioned the word path twice. What is the difference 
between the first time you said it with the prefetch 
file name and the path for a side of the prefetch file, 
what's the difference between those two paths? 

A The first one the column on the left, 

that ' s the actual physical location on the computer of 
that WGet prefetch file. You can site it's C Windows 
on is prefetch and there is the WGet prefetch files . 

The path on the right is looking within 
those individual prefetch files and it shows you where 
WGet was run from. 
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Q Now, when you say run from, what do you 

mean? 

A The location on the hard drive where it was 

executed. 

Q And how did you create this exhibit 

Prosecution Exhibit 188 for identification? 

A This is a using the Encase forensic program 

extracted this information. 

Q What information did you extract and what 

information did you add? 

A I added the first column which is line 

numbers and the column, the fifth column, the program 
switch which created the prefetch files and I also 
created the header. 

Q On the top? 

A Yes . 

Q And is this a fair and accurate 

representation of the information that you pulled from 
Encase? 

A Yes . 

Q What information on this document did you 
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add — you just explained that . 

So going now to the path within the 
prefetch file to the far right could you please explain 
to the Court what that means as far as the first entry 
for number one? 

A It means that WGet . exe was run from 

documents and settings that (INAUDIBLE) and that's 
where it was run from. 

Q How do you know that? 

A Because that's within the prefetch file. 

Q Is that automatically generated? 

A Yes . 

Q And for another example what about line 20. 

Start from the line number and explain line 20. Start 
from the line number and explain the whole line for the 
Court please . 

A Line number 20. First column is the line 

number, number 20. The second is the physical location 
of the WGet prefetch file on the. 22 computer. The next 
one is the date it was first created and the date the 
second column — fourth column, excuse me, was the date 
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it was last. run. WGet (INAUDIBLE) was the program that 
created the prefetch file path where is run from, was 
documents and settings . Settings bear that name shows 
sending bradley . manning my document and before the 
name . 

Q When you say a program runs from their 

WGet, in this instance where was it physically saved to 
another hard drive? 

A It was physically saved in the directory . 

It was shown the, blue folder. 

Q While this image is still up, what does the 

term unknown mean in the column? 

A Several WGet, the files have been deleted 

and rewritten and the contends have been rewritten . I 
don't know where they were run from. 

Q When you say the WGet file or did you mean 

the WGet prefetch file? 

A The WGet prefetch files . 

Q I'm going to zoom though it to show the 

whole document. Why are there 20 instances listed 
here , 2 rows ? 
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A That means WGet was run from 20 different, 

locations on that hard drive. 

Q In your experience, why would a user run 

WGet from different locations? 

A You can using download files — if WGet was 

run from multiple locations at the same time they can 
each be downloading a large set of files . So together 
writing simultaneously you can download an even larger 
set of files . 

Q Where did PFC Manning store WGet and run 

the program from? 

A Which time? 

Q Well, what computer was it stored on? 

A This is the .22. 

Q Did you see any — I asked you a very broad 

question, but based off of your analysis at least of 
the prefetch file what was the general location or the 
most specific location where they all were run. 

A In my documents folder within the 

Bradley . manning user file. 

MAJOR FEIN: Your Honor, the United States 
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moves to admit Prosecution 188 . 

MR. TOOMAN: No objection, ma'am. 

THE COURT: May I see it. Prosecution 
Exhibit 188 for identification is admitted. 

BY MAJOR FEIN: 

Special Agent Shaver, in your career how 
many U.S. Army computers or Windows have you seen 
WGet on? 

A Two . 

Q Which ones were those? 

A Dot .22 and .139. 

Q Are those are computers in this case? 

A Yes . 

Q Once WGet is copied onto a computer how 

does a user run WGet? 

A From a command prompt . 

Q What do you mean by command prompt? 

A The command prompt is a Windows program 

which allows a user to interface with the operating 
system and run programs which have a nongraphical 
interface . 
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THE COURT: What does that mean? 
THE WITNESS : A graphical interface . You 
can use your mouse, you can click on it. The 
nongraphical is just a text, there's no pictures. 
BY MAJOR FEIN: 
Q Special Agent Shaver, do one of the slides 

you created help demonstrate what that looks like? 
A Yes . 

Q Which slide is that. 

A Slide 4 . 

MAJOR FEIN: Your Honor, permission to 
publish slide 4 . 

THE COURT: Go ahead. 
BY MAJOR FEIN: 
Q Special Agent Shaver, before we continue 

just to seek clarification for the record, what is 
this? 

A That is a command prompt . 

Q And how did you create this image of a 

command prompt? 

A I created a Windows XP virtual machine . I 
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then created — added the user Bradley . manning and from 
that I logged as that profile. I then started at the 
command prompt and I took this screen shot . 

Q I'm going to ask you about how you started 

the command prompt. We'll get to that in a moment, but 
just again is this from PFC Manning's actual computer? 

A No. 

Q And how did you create this demonstrative 

aid? 

A Again, I created a Windows XP virtual 

machine. I added a user account named bradley . manning . 
I logged into that using the user account . I started a 
command prompt and I took this screen shot . 

Q So going back to the Court ' s question about 

graphical user interfaces, how does the command prompt 
that is displayed up here, how does one use the command 
prompt in general? 

A You would enter commands by text . 

Q And what do you actually mean by that? 

A You have to actually type out the commands . 

In this case WGet and it would you put several options, 
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you would identify the location of the file where you 
would like to download it from and then would you hit 
enter . 

Q When you use the command prompt, do have to 

use a mouse to click on options? 
A No. 

Q And does the command prompt let you 

navigate web pages? 
A No. 

MAJOR FEIN: Your Honor, I'm pulling off 
slide 4 of the exhibit . 

BY MAJOR FEIN: 
Q What happens when a user double clicks a 

program in Windows XP? 

A A program start . 

Q Does that matter if it ' s a installed 

program or is that true for an installed program? 
A Yes . 

Q Is that also true for a self —contained 

executable? 

A It depends on the executable. What its 
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function is. 

Q And what do you mean by that? 

A If, for example, the something executable 

is WGet you double click on it . The command prompt 
would open and close and it would not do anything. 

Q Why? 

A Because it was never — there ' s no 

graphical component . Again it ' s a command line tool 
only . 

Q So how does WGet run? 

A It runs by use of through a command line . 

You type WGet . You would tell it time what you would 
like to save, the file name and where would you like to 
get file from. 

Q Are there options that a user has when they 

run WGet? 

A Yes, sir. 

Q And how does one learn of those options? 

A In the command prompt if you type WGet and 

you put space dash H, H for home, you hit enter, the 
help file will appear on the screen. 
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MAJOR FEIN: Your Honor, I'm handing 
Special Agent Shaver Prosecution Exhibit 189 for 
identification . 

BY MAJOR FEIN: 
Q Special Agent Shaver, could you please 

review that and let me know when you're finished. 
What is that document? 
A This is a document that I pulled, I 

extracted from the .22 computer from bradley . manning ' s 
user profile. It is the WGet help output file. 

Q How do you recognize that document? 

A My initials are on it . 

Q Have you seen the information on that 

document before you report finding it on PFC Manning — 
A I have . 

Q Where have you seen the information within 

t hat do cument ? 

A The use of WGet . 

Q What did you mean by that? 

A At CCIU I used WGet on a regular basis. 

MAJOR FEIN: Your Honor, permission to 
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publish . 

THE COURT: Go ahead. 
BY MAJOR FEIN: 

Q Special Agent Shaver, could you please 

explain briefly what this document — explain what the 
document is is trying to explain? 

A How do use WGet . It is a three-page 

document of all of the options you can do with WGet and 
this is the command line you would have do build to 
make it run . 

Q And what do you mean by options? 

A To do something it ' s a choice . For 

example, the dash capital O. Do you see that. 

Q Where with is dash capital O? 

A It's. 

Q Is it under a subsection? 

A Yes , download . 

Q Is the second down from download? 

A It is. 

Q Please go ahead. What about capital O? 

A That writes documents to a file. So if you 
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download a file it will tell you the file name at this 
time will write that file name . 

Q So when a user's running WGet, how does one 

download a file or file name that you just described? 
What do they have to put into the command prompt? 

A They would have to put WGet space dash 

capital O and a file name filed by a URL of the 
location of the file would you like to download. 

Q What do you mean again by the URL? 

A That is a location on the Internet where 

the file resides . 

Q Going back to these options . How many 

options to you estimate there are for running WGet? 

A There are three pages. Quiet a few. 

Q Three pages worth of these types of 

options? 

A Yes . 

Q So what does a user have to figure out 

ahead of time before they run WGet? 

A What they want to do. They need to first 

identify where the file is on the Internet, where they 
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want to download it from. 

Q Why does a user need to know where and what 

file they need to download? 

A WGet needs a specific location of the file 

on the Internet to be downloaded. 

Q What else must a user do before they can 

run WGet? You mentioned they have to identify a 
certain document? 

A They need the full path of the document, 

obviously have WGet and where they want to store it . 

Q You're talking about if you assume, and 

please correct me if I'm wrong, that this is only if 
you're downloading a single document, correct? 

A Correct . 

Q But there are other ways to run WGet? 

A Yes , many . 

Q And why must a URL or address be specific? 

A The Internet is not vague, it has to be 

specific address to find a specific file. 

Q So once a user puts in this information in 

the command prompt, what do they do? 
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A Command it . 

Q What happens then? 

A With WGet download, navigate to the URL in 

question and download the file that you receive and 
save as the file name. 

MAJOR FEIN: United States Prosecution 189. 
MR. TOOMAN: No objection. 
THE COURT: May I see it, please? 
Prosecution Exhibit 189 for identification is admitted. 
BY MAJOR FEIN: 
Q Special Agent Shaver, did one of the slides 

explain the components of a WGet file? 
A Yes . 

Q What slide? 

A Slide number three . 

MAJOR FEIN: Your Honor, permission to 

publish 183. 

THE COURT: Go ahead. 
BY MAJOR FEIN: 
Q Special Agent Shaver, could you please 

explain how did you create that slide? 
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A I made up a web address and I looked at the 

help file and I broke it down by sections . 

Q So could you please explain to the Court 

based on this slide how a user would download a single 
file from a known web server? 

A The left right is WGet is the first one in. 

The next one is dash capital O and the file name l.PDF. 
This is what you want to save and where you want to 
save it . 

The next block is the web address of the 
web server and where it ' s located on the Internet and 
finally the last blocks the file name would you like to 
download. 

Q Now, Special Agent Shaver, you said that 

the dash capital O and then you didn't say space, but 
there's a space over there as a file name where you 
want to save it. What do you mean, where you want to 
save it? 

A The path to where you want to save a file . 

If run a WGet from one folder and you would like to 
save it to another you would have to put it on a 
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different path so the program knows to store the file. 

Q If you do not put this path information in, 

like this example here, where does that file that's 
being downloaded on WGet, where does it store on the 
hard drive? 

A The same folder that WGet is run from. 

MAJOR FEIN: Your Honor, removing slide 
three of prosecution Exhibit 187 for identification. 

BY MAJOR FEIN: 
Q Special Agent Shaver, did you visit the web 

site? 

A I did. 

Q Did it have a web page? 

A It did. 

Q What was that address for URL. web page. 

A NCD . state . sgov . gov . 

Q What is that, the website or web page? 

A That is the website. 

Q What's the actual address of the web page 

for the NCD? 

A HTTP : //NCD .state . sgov . gov . /index . HTML . 
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Q When you were on that web page was that the 

main page from NCD database? 
A Yes. 

Q How do you know that? 

A I went there . 

Q And did that web cite give you an option to 

view cables on its face? 

A No, you had — there was a search function. 

Q Did you attempt to search for a cable? 

A I did. 

Q Did you search nor a cable? 

A I did. 

Q What happened once you searched for the 

cable . 

A I was present with a choice and you could 

click on the cable and view the contents. 

Q When you clicked on the cable to use its 

contends, what happened on your computer when you 
clicked on the cable? 

A It displayed within my web browser. 

Q Is that an example of a link to another web 
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page you testified about earlier? 
A Yes . 

Q And, in general, why did you go to NCD 

database for this case? 

A I was told NCD cables were involved in this 

case . I had never seen one before and I wanted to see 
what one looked like . 

Q When did you go to the web page? 

A Summer of 2010. 

Q Now, I ' d like to focus your testimony on 

how PFC Manning ran WGet on his SIPRnet computer. You 
testified earlier that the multiple folder within my 
documents . 

I'm now going hand you PE100 for 
identification. This is a previously marked. 

THE COURT : Which exhibit are you pulling? 

MAJOR FEIN: Prosecution 100 for 
identification, ma'am. 

BY MAJOR FEIN: 
Q I'm now handing you Prosecution Exhibit~100 

for identification. 
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A Okay . 

Q Do you recognize that document? 

A I do. 

Q And what is that document? 

A This is the document backup that XLXS which 

I extracted from the . 22 computer from the 
bradley . manning user profile. 

Q How do you recognize that document? 

A I created the screen shot . 

Q Is that same document previously testified 

about a month ago with — 
A Yes. 

MAJOR FEIN: Permission to publish Your 

Honor . 

THE COURT: Go ahead. 
BY MAJOR FEIN: 
Q Can you please explain for the Court first 

of what file type did this screen shot come from, what 
file and what was its file type? 

A This was an Excel spreadsheet and the file 

type would be XLX. 
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Q What does the WGet at the bottom left of 

the exhibit show? 

A That is the sheet of the workbook . 

Q And now just using the top portion as an 

example, what does this exhibit show? 

A It shows WGet dash capital O save any file 

as 10 canbara 153.HTMO from the web server 
HTPP : //NCD . state . sgov . gov and a slash message slash 
similar reference and the file is downloading is 10 
canbara (INAUDIBLE) 153. 

Q So going through this example and you write 

line 10926? 

A Right . 

Q What web server is the file being 

downloaded from? 

A The NCD web server . 

Q How do you know that? 

A From the address. 

Q And what is the file name of the file 

being — what is the file name of the file on the 
server? 
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A The file name is 10 canbara 153. 

Q And do you recognize that naming convention 

for our investigation? 
A Yes . 

Q What is that? 

A That is an MRN. 

Q What is an MRN? 

A Message record number. 

Q Where have you seen that in general? 

A Through this case and on the NCD website, 

sir . 

Q Now, is there a file type associated like 

on this prosecution exhibit for identification with 
what ' s sitting on the web server? 

A No. 

Q And what file type is it being served at? 

A HTML. 

Q How do you know that? 

A Because it says ways WGet space dash 

capital O 10 canbara 15. 

Q Now, what information would PFC Manning's 
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machining need in order to create this Excel document 
with WGet commands and specifically what pages on the 
web server? 

A You first need to know obviously the 

address, the URL of the web server and all the specific 
path to the files and a listing of the files he would 
like to have downloaded. 

Q Why do you need the list of the files that 

you want to download or why would he need the list of 
those MRNs? 

A You needed to downloaded them, wanted to 

downloaded them, and he needed a list of what do 
downloaded . 

Q Would WGet have worked otherwise? 

A I don't think so because the NCD, these 

files were not linked on mass to the front web page . 
There was a database more or less in the back end. So 
the user would have to search the NCD . state . sgov . gov 
(INAUDIBLE) server to identify the cable they wanted to 
download . 

Q In order to obtain the information of the 
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actual cables and their names on the server, what would 
PFC Manning need to be able to do or what did he need? 

A He needed the address . He needed the cable 

names . 

Q And did you find any evidence of how he 

obtained the cable names? 
A Yes. 

Q What evidence did you find of how he did 

this? 

A On Intel Link there was a search from the 

.22 computer to the NCD.state.sgov.gov and a query was 
like a search of new cables . It was a listing and it 
provided a list of the hundred cables or so. 

Q And did that result give a list of the 

cable names? 

A It showed up, yes. 

Q And then what at least could a user do with 

a list of cable names? 

A In this case copy them and then place them 

into Excel . 

Q When you examined this Excel worksheet, or 
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excuse me, this backup XLX text file, what did you 
observe on how PFC Manning created these WGet commands? 

A If you'll notice at the top that says 

column B. Column A is nothing but the names itself 
with no extensions and a canbara (INAUDIBLE) . 

What happened is this is a — this is a 
function of Excel and concatenate the contents of the 
first half, the first column, which would just be the 
names and it created this output . 

Q What do you mean by concatenate? 

A Concatenate is a Excel function to put 

pieces together. In this case, this would — he 
would — it was going to get WGet dash O and then it 
had instead of the file name from to 10 canbara 153 it 
actually read the column A and then it would put that 
in there automatically and filed by .HTML and then it 
would have that address and reference and it would read 
in column A to populate this field. It was a way of 
being automated? 

THE COURT : Let me stop you . Where do you 
get the information from column A? 
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THE WITNESS : That ' s where you read the 
names. You can go to NCD, you would search for in this 
case the newest cables . You would say here are your 
cables. You copy that list of names, populate it into. 

BY MAJOR FEIN: 
Q And just that last portion. How would a 

user do that? You have the web page you said and you 
the newest 100 cables? What would you do on the 
computer? 

A Highlight, copy it, and then paste it into 

Excel . 

Q And then once you paste it into Excel based 

off the formulas in Excel what would you have in this 
column that you're looking at? 

A This would populate it . It would then 

create WGet commands . 

Q Is that an automated process? 

A It would be, yes. 

MAJOR FEIN: Your Honor, United States 
moves to admit Prosecution 100 for identification as 
Prosecution Exhibit~100 . 
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MR. TOOMAN: No objection, ma'am. 
THE COURT: Prosecution Exhibit~100 for 
identification is admitted. 

BY MAJOR FEIN: 
Q Now, based off of your analysis of PFC 

Manning's computer, what did then PFC Manning do with 
that Excel spreadsheet with the WGet commands? 
A You mean .22? 

Q Yes . 

A He then would have copied column B into a 

batch file and then run the command. 
Q What is a batch file? 

A That is a file that contains limited 

instructions for programs to run in through command 
prompts . You read the first one and once it does the 
second line and third line and so on until it ' s done . 

Q Why would a batch file be needed in order 

to run WGet? 

A Because in this matter the way this was 

done he would have to either run them in mass as a 
batch file or copy and paste each one into command 
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prompt, hit enter. It would download copy and paste, 
and this was just a way to automate it . 

Q What final type is associated with batch 

files? 

A The file type as .BAT. 

Q How does a user create a batch file? 

A The easiest way is to open notepad, which 

is a text editor, and put your contents in there and 
then save it as a file extension .bat. 

Q Is a batch file a graphical user interface? 

A It is not . 

Q What is it? 

A It is a — again, it's just a command. 

It ' s a series of linear steps for the command prompt to 
execute . 

Q And did you find any evidence of a batch 

file being used by PFC Manning? 
A I did. 

Q What did you find in the unallocated space? 

A In the unallocated space I found a 

partially deleted remanence of a batch file. 
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Q Special Agent Shaver, I'm now handing you 

Prosecution Exhibit 190 for identification. Do you 
recognize that document? 

A I do. 

Q And how do you recognize that document? 

A This is a document I created. This is a 

extract . 

MR. TOOMAN: We've just seen this for the 
first time. We'd like the opportunity to talk about 
this document with our expert . 

THE COURT : How long do you need? Any 

objection . 

MAJOR FEIN: No, ma'am. 

THE COURT: The Court will be in recess for 

15 minutes . 

(Hearing recessed at 4:38 p.m.) 

(Hearing resumed at 5:00 p.m.) 

THE COURT: Major Fein, did you have 
anything you wanted to do on the record? 

MAJOR FEIN: Yes, ma'am. Earlier when the 
Court came out to ask the question about the 641 
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offenses, when asking the United States I stated that 
the charge sheet specifically stated that the 641 
offenses state that a database containing — this is 
for the CIDNE 641 offenses. That CIDNE contained 
SigActs and the actual charge sheet that is the CIDNE 
database containing records, not SigActs. 

THE COURT: Let the record reflect that the 
witness is on the witness stand. 

BY MAJOR FEIN: 

Q Special Agent Shaver, I'm showing you 

Prosecution Exhibit 190 for identification. Have you 
seen this document before? 

A I have . 

Q What is this? 

A This is a screen shot of the — from the 

.22, the allocated space. It's a screen — this is 
something I created. 

Q How do you recognize it? 

A I created this . 

Q And what is a screen shot of? 

A The unallocated space . It was a deleted 
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batch file . 

MAJOR FEIN: Your Honor, permission to 

publish . 

THE COURT: Go ahead. 
BY MAJOR FEIN: 

Q Now, before we broke you testified about 

the use of batch files and the different places you 
found evidence of batch files being run. 

So where did this information that ' s on 
this exhibit come from? 

A The unallocated space within . 22 . 

Q And could you please explain to the Court 

what this extract for that unallocated space shows? 

A It shows a series of WGet commands 

downloading a number of MRNs, Department of State 
cables from the Department of State server . 

Q How does this extract compare to at least 

format— wise, and content— wise, to the WGet tab on the 
back up XLX file? 

A It has the same content, same format, WGet 

space dash capital O space message record number .HTML, 
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the web assess to NC state and (INAUDIBLE) finally the 
file which is being downloaded. 

Q And why do you conclude that this is a 

recovered batch file from his .22 SIPRnet computer? 

A Because that is what script would have 

looked like . It ' s just a linear set of commands . 

Q And when a batch file such as this one is 

run, what does the computer do? 

A It reads the first line and executes it and 

then the next line and continues on through until it 
runs out of commands . 

MAJOR FEIN: Your Honor, United States 
moves to admit what has been marked Prosecution Exhibit 
190 identification as Prosecution Exhibit 190. 

MR. TOOMAN: No objection, ma'am. 

THE COURT: Prosecution Exhibit 190 is 

admitted. 

BY MAJOR FEIN: 
Q Special Agent Shaver, what is the NT user 

file DAT file? 

A That is a Window's registry file that 
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pertains to a specific user on a Windows computer. 

Q What do you mean by a Windows registry 

file? 

A That is a file that every user on the 

computer has and it maintains information that in user 
account. For example, the last ten documents, the 
office documents, that is maintained within your NT 
user file. 

Q Is this a file that's generated by the user 

or is it automated? 

A It is an automated file populated by 

Windows . 

Q In your example when you said like a 

Microsoft file, is it a general Microsoft office file 
or is it by file type? 

A It's by file type. 

Q And what information does it log when it 

comes to file types? 

A It will show you the last ten times that 

file type has been accessed. 

Q Was there any evidence in PFC Manning ' s 
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NTuser.DAT file of batch files being run on his SIPRnet 
computer? 

A Yes. 

Q How do you know that? 

A Within the .22 profile .22 on the 

bradley . manning user profile I explained in that that 
it maintained the last ten batch files which would have 
been accessed. 

Q Special Agent Shaver, I'm now handing you 

Exhibit 191 for identification. Would you please look 
at that? 

A Yes, sir. 

Q What is that document? 

A This is a document I created. This is a 

screen shot of the (INAUDIBLE) concerning the batch 
files, last ten batch files. 

Q What do you mean by concerning? 

A That ' s what it is . These are the last ten 

batch files which were opened and saved. 

Q How do you recognize that document? 

A I created it . 
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Q Thank you. Permission to publish? 

THE COURT: Go ahead. 
BY MAJOR FEIN: 
Q Starting from the top down could you please 

explain for the Court what that exhibit is? 

A The first line is the actual key where this 

information was stored. The next line is the last 
written time that he had been updated. 
Q What do you mean by key? 

A The registry stores keys . Registry files 

maintains files and information by the use of keys . 
It ' s like a database and each record would have its own 
information . 

Q And what is the key that ' s being used for 

this exhibit? 

A It's located on Windows current version of 

Explorer com DLG 32 open save MRU bat . 

Q What does the bat at the end of that key 

mean? 

A That is the batch files . Anything with 

a. bat extension is there, the last ten. 
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Q And now what about the last class name the 

top portion of this? 

A The last written time is last time in this 

batch file a registered key would have been updated. 
What that means is the last time that something — a 
batch file had been opened and saved. 

Q And now what does the first line under name 

type and data, what does that first line mean? 

A That means the order of which things were 

put in . 

Q What do you mean by things put in . 

A The registry keys. If you look at the left 

it says MRU list and then it has the first one as IGED 
if you read down. If you look from left to right under 
the top data field, again, has the order of which 
the — they were put in there. A was the first, B was 
the last, and then it goes up to I as being the newest 
document . 

Q And then what does the information show 

below that first line where it says MRU list and the 
IGD? 
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A It shows the path of the batch files which 

have been run . 

Q What did you bean my path? 

A The physical location on the hard drive. 

Q What did your observe and do you observe 

about the these last ten bath files? 

A They were all run from the bradley . manning 

user profile under the documents in the folder bloop. 

Q And how does one determine how to name a 

batch file? 

A You can name it anything you want, but you 

must have extension .bat. 

Q And so, for example, the second line golf, 

what does that tell you? 

A That tells me the file move. bat was present 

in the bloop folder . 

Q Why does it tell you that? 

A Because that was the bath of where it ran 

from. 

MAJOR FEIN: Your Honor, United States 
moved to admit Prosecution Exhibit 191 for 
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identification . 

MR. TOOMAN: No objection. 

THE COURT: Prosecution Exhibit 191 is 

moved . 

BY MAJOR FEIN: 

Q Special Agent Shaver, did you find a folder 

on PFC Manning's SIPRnet computer that contained a 
batch file and the associated files using WGet? 

A I did. 

Q Where did you find that? 

A It was in the bradley . manning user profile 

on .22 and the folder's name was bloop . 

Q I'm retrieving from the court reporter 

Prosecution 104 for identification: 

Special Agent Shaver, I'm now handing you 
Prosecution Exhibit 104 for identification. Do you 
recognize that document? 

A Yes , I do . 

Q What is that document? 

A This is a screen shot of the forensic 

program that I created. 
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Q Is that the same exhibit you referenced in 

your previous testimony with Captain Morrow? 
A Yes . 

MAJOR FEIN: Permission to publish, Your 

Honor . 

THE COURT: Go ahead. 
BY MAJOR FEIN: 

Q Special Agent Shaver, could you please 

explain to the Court what is displayed in this exhibit 
that you pulled? 

A What these are, these are again as previous 

testimony, you will see the back up .XLXS. 

Q Where are we looking? 

A Six up from the bottom. 

Q Okay . 

A And also files .zip. The files .zip was 

the partially corrupted zip file that we spoke of 
earlier, and the second from the bottom is move. bat, 
that is the batch file. 

Q So just to orient, what is the left column? 

A The column with the file name. 
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Q What is the right column? 

A That is the file creation time. 

Q And what does this left column show? 

A It shows the names of the files that are in 

that folder . 

Q And what else, what kind of information is 

contained in that folder pulled from the Department of 
State server? 

A There are several MRNs, deleted MRNs that 

are there and the file. zip that contains over 10,000 
MRNs from the Department of State server . 

Q What do you mean by that? 

A They have been deleted. 

THE COURT : How many file names did it 

contain? 

THE WITNESS: It contained over 10,000. 

THE COURT : Thank you . 

BY MAJOR FEIN: 
Q And what do you mean by — first what does 

that symbol next to the MRN represent? 

A If you look at the first one that symbol 
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means the file has been deleted. 

Q What is the bigger symbol next to the MRN? 

A It is a file. It shows it's a file and it 

shows that it ' s the slash line through it means it ' s 
been deleted. 

Q And — 

THE COURT: What slash line? 
BY MAJOR FEIN: 

Q Could you use your screen and circle, 

please? 

A I'll try. Right there. 

THE COURT : Got it . 
BY MAJOR FEIN: 
Q So are you talking about next to the very 

first entry 10 ancra 2 9 9HTMLHTML that there is a icon 
that looks like a piece of paper with a circle with a 
slash through it? 
A Yes . 

Q And that ' s what you just circled? 

A Yes, sir. 

Q And what do you mean by it was deleted? 
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A The file has been deleted. The contents of 

the file has been deleted, but the entry within the 
master file table, the MFT, is still present. 

Q And did during forensic exams remnants of 

deleted files, Department of State files specifically, 
were they recovered? 

A Yes . 

Q And then you talk about backup XLXS, is 

that the file you testified about earlier? 
A Yes . 

Q What about move . bat ? 

A That is a batch file. It has been deleted 

and the contents has been overwritten. I do not know 
what the exact content of that was . 

Q What folder is this showing the contents 

of? 

A The folder is bloop . 

MAJOR FEIN: Your Honor, United States 
movers to admit Prosecution 104 for identification as 
Prosecution Exhibit 104 . 

MR. TOOMAN: No objection. 
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THE COURT: Prosecution Exhibit 104 for 
identification is admitted. 

BY MAJOR FEIN: 

Q So when PFC Manning was running WGet in his 

my documents folder, the way he had programmed it where 
did the file save to? 

A The same folder the WGet was run from. 

Q How was that reflected in the exhibit that 

was just displayed? 

A The WGet files were there. The HTML files 

that would indicate WGet was run from that folder . 

Q Would it be in the same folder as the batch 

file? 

A Yes. 

Q And was that specific move. bat file 

reflected or accounted for in the NT user. data file? 
A Yes . 

Q Was running WGet . exe in that bloop folder 

contained in the prefetch file? 
A It was . 

Q Now, if WGet was run from a CD or DVD, how 
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would that be captured within the same files you've now 
discussed, if at all? 

A It would not have — the methodology that I 

just used from the (INAUDIBLE) would it not have worked 
because you cannot write to the CD . You would have to 
write to somewhere on the computer within the user 
profile . 

Q Why is that? 

A Because CDs are redundant . You need to — 

WGet knows how to — WGet can download a file, but it 
has to be able to write output to something. 
Q What if it ' s a rewritable CD? 

A Another program would have to do that . 

WGet does not have that capability? 

MAJOR FEIN: Your Honor, permission to 
publish slide 2 of Prosecution Exhibit 187 for 
identification . 

THE COURT: Go ahead. 
BY MAJOR FEIN: 
Q Special Agent Shaver, earlier you testified 

as a demonstrative that this slide you created shows 
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how WGet could run. Using the same exhibit could you 
please explain how PFC Manning, in your opinion, ran 
WGet from his SIPRnet computer? 

A First, he downloaded it from the web site 

using a NIPRnet computer. In this case .139. The file 
was burned to a CD, transferred over to the SIPRnet 22, 
40. As in place on — within his user profile. He 
then navigated to NCD.state.gov using a web browser, 
identified the cables that at he wanted to download. 
He then hocked them back up that XOXX, copied and 
pasted those MRNs into that which would then populate 
the field and create the correct command line for WGet 
to operate . 

He would then have copied the WGet all the 
commands in.XLX into a batch file and then executed had 
batch file . 

Q When that batch file executed, how did WGet 

retrieve the web page from the web server? 

A Download the file by navigating directly to 

the web server copying the file from the web server and 
saved it locally as an HTML file. 
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Q So using your aid, what path did it follow? 

A The request went up the red line from the 

bottom left to the middle, went to that one, and then 
it navigated to the files and then the return path 
would have been to a local machine . 

Q And when that occurred did PFC Manning ' s 

computer go on to the next sent diplomacy web page that 
you visited to search cables? 

A WGet did not . 

THE COURT : Ask that question again . 
BY MAJOR FEIN: 

Q When PFC Manning would have run that from 

his SIPRnet computer, did WGet access the web page to 
download the cables or did it go straight to the 
server? 

A It went straight to the server. 

MAJOR FEIN: Your Honor, United States 
moves to admit Prosecution Exhibit 187 for 
identification as Prosecution Exhibitl87 . 

MR. TOOMAN: I would object that the 
government served that it was demonstrative and 
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(INAUDIBLE) . 

THE COURT: May I see it? Why isn't it a 
demonstrative aid proper for admission? 

MR. TOOMAN: Your Honor, it's not evidence, 
it ' s just created by this witness . 

MR. COOMBS: Additionally the witness 
testified that it would aid him in his testimony. So 
this is essentially reinforcing his testimony for the 
trier of fact . If it was used as a demonstrative aid 
as he was explaining his testimony to the trier of fact 
by admitting this it is not evidence in the case . This 
is simply something that the witness created on their 
own in order to aid their testimony. 

THE COURT : Demonstrative evidence can be 
admitted in this case. I don't see any basis for the 
defense objection. So I'm going to go ahead and admit 
it, understanding it's demonstrative. 

BY MAJOR FEIN: 
Q Special Agent Shaver, now I'd like to 

direct your testimony to evidence you found of Twitter 
and tweets? 
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THE COURT : Yes . 

MR. TOOMAN: We're going to object. 
Again, the government gave notice that they would 
elicit testimony about Wikileaks tweets that were 
found on the accused personal computer. No 
Wikileaks tweets why actually found on PFC Manning's 
Macintosh computer. The witness would say the URLs 
or the link essentially to Wikileaks tweets were 
found on the computer . 

So those tweets weren't actually found 
on the computer . There ' s no evidence on the 
computer that PFC Manning ever viewed those tweets 
or saw those tweets . There ' s no evidence that he 
went to the web page . 

So he would say it ' s not appropriate for 
rebuttal. In addition, we get to the point where we 
actually see the tweets, those tweets were totaled 
purpose of them is to rebut the idea that Wikileaks 
is a journalistic those. 

Tweets have nothing to do with whether 
or not Wikileaks is a journalistic organization. 
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THE COURT: Well, the Court degrees with 
that, but what are you trying to elicit? 

BY MAJOR FEIN: 
Q Your Honor, factual. The first parts 

absolutely tree and Special Agent Shaver testified that 
he found the links to these tweets and then he went on 
to Twitter and found where they are . The purpose of 
this testify is exactly as articulated before, the 
defense proffered the evidence from Professor Bankler ' s 
letter about the relationship Wikileaks has to the 
press entity and we intend to offer these to show — 
and the defense intends to argue that PFC Manning knew 
that then he would have also had evidence on them that 
shows it was not, and these tweets, as the Court will 
seal show that, or least provide a reasonable inference 
that it was not a legitimate news organization? 

MR. TOOMAN: Another position on the 
substance of these tweets is that they have no bearing 
on Wikileaks ' relationship to the media or their 
standing as a journalistic organization. 

THE COURT : I can overrule that . I'm going 
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to let it in . 

Go ahead . 
BY MAJOR FEIN: 
Q For the past two weeks have you had the 

opportunity to search PFC Manning ' s personal Mac for 
any evidence of Twitter? 
A I have . 

Q And specifically any evidence that would 

relate back to the Wikileaks Twitter feed? 
A Yes . 

Q And where did you find evidence that you 

answered yes to? 

A In the unallocated space . 

Q Did you find it anywhere else as well? 

A In the allocated, yes . 

Q Where in the allocated space? 

A Within the B Manning user profile there was 

a web browser called Sapphire . Inside there was a 
database that contained information to those files 
pertaining to the substance . 

Q And what file on PFC Manning's personal 
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Macintosh computer did you find in the allocated space 
information related to Twitter and Wikileaks? 

A It was a web icon . database . 

Q What is that? 

A If you go to the web — if you open up a 

web browser . 

MR. TOOMAN: Your Honor, we're going to 
object to whether or not there was evidence of Twitter 
or Wikileaks on PFC Manning's computer has no bearing 
whatsoever as to whether or not Wikileaks is a 
journalistic organization. 

THE COURT: Whether Wikileaks is a 
journalistic organization, the relevant inquiry is 
whether PFC Manning believed they were, right? 

MR. TOOMAN: Paragraphs, Your Honor, but 
whether or not he ever visited Twitter or Wikileaks, 
that's already established on the merits and certainly 
not anything we offered in our case in chief. It's 
unclear what ' s — 

THE COURT : I disagree . It ' s proper 
rebuttal for Mr. Bangler ' s testimony. 
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BY MAJOR FEIN: 
Q What is it ' s web database? 

A That is the database called favor corns and 

those are you recall icons. If you were going to the 
Washington Post web page to the left in the address bar 
to the left of that would be a little WP . It ' s a way 
of branding their web pages . This database maintained 
those websites that have been visited. 

Q And is this database populated 

automatically by a Mac or by Safari or is it done by 
the user? 

A Populated automatically by Safari . 

Q Special Agent Shaver, I'm handing you 

what's been marked as Prosecution Exhibit 192 for 
identification. Special agent, what is that document? 

A This is a document I created. This 

contains the web page icons database . 

Q How do you know that? 

A I created this . 

Q Where did that information come from? 

A It came from the file called file located 
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in the Macintosh hard drive, the path is users Bmanning 
weinberry Safari far web page . 

Q Was this in the allocated or unallocated 



space 



It was allocated. 

MAJOR FEIN: Your Honor, permission to 



publish . 



THE COURT: Go ahead. 
BY MAJOR FEIN: 

Q So Special Agent Shaver, based off of my 

original question, what information — first of all, 
what information on this exhibit did you pull from the 
actual file? 

A The second column and the third column . 

Q And what are the column names? 

A You recall and icon ID . 

Q What did you add to this? 

A I added the title above and the line 

numbers . 

Q What is the title above show? 

A The math of the file as it was located. 
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Q Is that the path you just discussed? 

A It is. 

Q And what does the number reflect? 

A The just a line number . 

Q And are those sorted in any way? 

A That ' s how — when I extracted it was the 

order informs . 

Q What does the URL column show? 

A It shows a path to a web site . 

Q And go ahead? 

A Website or web server or individual 

article . 

Q And what does the icon ID column tell you? 

A This goes back to the icons I spoke of. If 

you look at the Twitter, all the Twitters have the same 
icon ID number three on the right . They all have the 
same icon. So Twitter has its own icon. 

Q And what does a user of Safari on a 

personal on a Macintosh have to do in order to have 
this database populate with an entry? 

A Go to that web page . 
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Q And what does line 4 state? 

A ACDB Twitter.com/Wikileaks. 

Q What is that website? 

A That is the feed for — the Wikileaks feed 

for Twitter. 

Q Now, is that the exact path of the feed 

today? 

A No, sir. 

Q What is different? 

A Twitter has moved from HTTP to HTTPS . 

Q And very general terms what is the 

difference between HTTP and HTTPS? 

A It adds a secure socket to encrypt it . 

Q And what does line 6, what does that mean? 

A That means Twitter . com a search was 

conducted for the key word Wikileaks . 

Q And what about line 7? 

A The same . 

Q What about line 8 and 9? 

A Line 8 is a web page Wikileaks . com path . 

There ' s a Wikipedia and there ' s a document of 
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apparently access U.S. underscore, intelligence, 
underscore, plan to destroy Wikileaks and there's a 
date . 

Q What about line 9? 

A Line 9 is a web page, 

Wikileaks . com/wiki/wikileaks . 

Q What about 16 and 17? 

A Sixteen is web page, Wikipedia concerning 

Julian Assange. 

Q And line 17? 

A Line 17 is Wikipedia web page concerning 

the Wikileaks . 

Q Now, you mentioned the Washington Post 

earlier. Is there any evidence here that PFC Manning 
also visited a Washington site associated with the 
Washington Post? 

A Yes, 18. 

Q How do you know that? 

A WWW . WashingtonPost . com . 

Q Thank you. 

MAJOR FEIN: Thank you, Your Honor United 
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States moves to admit Prosecution Exhibit 192 for 
identification, Prosecution Exhibit 192 . 

MR. TOOMAN: No objection. 
THE COURT: Let me see it. 
Prosecution Exhibit 192 for 
identification is admitted. 

BY MAJOR FEIN: 

Q Special Agent Shaver, a moment ago before 

the favorcons database you testified that you found 
evidence of Wikileaks Twitter feed in both the 
unallocated space and the allocated. What evidence did 
you find in general in the unallocated space? 

A Several unique URLs to specific Twitter 

tweets pertaining to Wikileaks . 

Q What did you do when you found these? 

A I went to computer, to a NIPRnet computer. 

I wanted to see were these valid tweets, and so I went 
to the web page and pulled that URL up and put that up 
and witnessed the results . 

Q Special Agent Manning I ' m handing you 

what's been marked as Prosecution Exhibit 194A, B, C 
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would you look at those and let me know when you ' re 
finished. 

A (Witness reviewing document.) 

Q Do you recognize those three documents? 

A I do. 

Q What are those? 

A These are in case reports concerning the 

mentioned tweets concerning Twitter.com from the 
unallocated space of PFC Manning's personal Macintosh 
computer . 

Q Are all — how did you — are those 

documents you created? 
A They are . 

Q How did you create those? 

A From EnCase I created a report based upon 

the findings . 

Q Is that the report for all three of them? 

A It is. 

Q And is there any difference what are the 

differences between those three pages? 

A Two of three are actual direct URLs into a 
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specific Twitter on Wikileaks . The third one is a 
search of Twitter . com key word Wikileaks . 

Q You said I think URL for Twitter on 

Wikileaks . What do you mean? 

A The address is Twitter.com/Wikileaks/status 

and a unique number . 

MAJOR FEIN: Permission to publish, Your 

Honor . 

THE COURT: Go ahead. 

BY MAJOR FEIN: 
Q Special Agent Shaver, I'm publishing 

Prosecution Exhibit 194 Bravo and Charlie. You 
mentioned there's two different types of the 
unallocated space information you found. Which one is 
this? 

A These are actual URLs to a tweet that was 

recovered that found in the unallocated space of the 
personal Macintosh computer . 

Q How do you know that each of those URLs are 

tweets? 

A I put that address into a web browser and I 
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went into the tweet itself. 

Q Did those two addresses when you put into a 

web browser pull up a tweet? 

A They did . 

Q Different tweets? 

A Yes . 

Q Now, was the address that came up with the 

web browser identical to the address on these two 
documents? 

A No. 

Q What was different? 

A The difference was, you should see, it's 

site HTTP,// twitter is now on HTTPs : // . 

Q Was everything after the HTTPS the same 

when you went to Twitter? 

A Yes . 

Q When did you go on Twitter? 

A Past couple of days . 

Q I'm now overlaying Prosecution Exhibit 194 

Alpha and whats this portion that you recovered from 
the unallocated space the search on Twitter . com and key 
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word was Wikileaks . 

How do you know the key word was Wikileaks? 
A The Q equals is the search. 

Q And what else, what other information does 

this cover unallocated space tell you? 

A Off to the right there was another tweet 

identifier with the numbers 125 off to the right. 

Q What ' s the whole number please . 

A It's 2558544922. 

Q How do you know that you call that a unique 

identifier, how do you know that? 

A I put that into again I went to Twitter and 

put that in as a identifier with the other two and a 
tweet concerning Wikileaks was there . 

Q Now, you said like the other two. Earlier 

you testified that you basically copied and pasted the 
HTTP : twitter/ /twitter . com that whole thing in there. 
Did you copy and paste this from Prosecution Exhibit 
194 Alpha into Twitter? 

A No. I just used the unique identifier. 

Q What else did you combine with that unique 



Provided by Freedom of the Press Foundation 



1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 



UNOFFICIAL DRAFT - 7/18/13 Afternoon Session 



141 



identifier? 

A The HTPS Twitter . com Wikileaks status . 

Q What occurred when you put that into the 

Internet explore? 

A A tweet concerning Wikileaks . 

Q And did you use Internet Explorer or 

Firef ox . 

A Internet Explorer . 

Q And then what did you do once you put those 

into a NIPRnet computer and brought up the tweets? 

A I printed them. 

MAJOR FEIN: Your Honor, United States is 
handing Special Agent Shaver Prosecution Exhibit 193 
Alpha through Charlie for identification and pulling 
off the projector the three exhibits, 194 Alpha through 
Charlie . 

BY MAJOR FEIN: 
Q Do you recognize this document? 

A Yes. 

Q What are those documents? 

A These are the screen shots I created. 
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Q How do you recognize those? 

A My initials are on them. 

Q Do you recognize the contents as well? 

A Yes . 

Q Earlier you testified that you used 

Microsoft Internet Explorer. What browser did you use? 
A Firefox. 
Q How do you know that? 

A The Firefox tab is present . 

Q And when you printed those — or what else 

do you recognize on that page? 

A The background is the Wikileaks logo . 

Q How do you know that? 

A I've seen it throughout this investigation. 

MAJOR FEIN: I'm going to retrieve from you 
those exhibits. 

Permission to publish. 
THE COURT : Yes . 
BY MAJOR FEIN: 
Q So Special Agent Shaver, I'm going to 

publish 194 and portions of 194 also. So this is 
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Prosecution Exhibit 194 Alpha for identification and 
here is the tweet that is Prosecution Exhibit 193 Alpha 
for identification. 

How do these two documents relate to each 

other? 

A They're the same unique identifier. 

Q How do you know that? 

A Because I copied that unique identifier 

into the browser and I hit enter . 
Q When you say that — 

A I'm sorry. Off to the right you see the 

number 125. 

Q Which is unallocated space or is it the 

tweet? 

A In the unallocated space . It says 

12558544922 . 

Q Yes . 

A I copied and pasted that into the Wikileaks 

status URL and this is what arrived, this is what was 
there . 

MAJOR FEIN: Your Honor, United States 
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moves to admit Prosecution Exhibit 194 Alpha and 193 
Alpha for identification as both 194 Alpha and 193 
Alpha . 

MR. TOOMAN: We do object, Your Honor. The 
Court has said it is relevant those things that 
informed PFC Manning's understanding of Wikileaks . 

This witness hasn't testified PFC 
Manning actually saw those tweets . All he said was 
there were links to those tweets on his computer. 

THE COURT : You can argue that when you do 
your closing argument. The inference could be there. 

Any other objection? 

MR. TOOMAN: No, ma'am. 

THE COURT: May I see it. 

MR. TOOMAN: Objection is overruled. 

THE COURT : Yes . 

MAJOR FEIN: Your permission to publish 193 
and 194 Bravo. 

THE WITNESS: Go ahead. 
BY MAJOR FEIN: 
Q Special Agent Shaver, similarly how do 
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these two documents relate to each other? 

A In the unallocated portion, the top you can 

see that address, the status, and that unique 
identifier. I pasted, I put that to the — I went to 
Twitter.com and put that same exactly address in and 
what appeared was the one below. 

MAJOR FEIN: United States moves to admit 
194 Bravo and 193 Bravo. 

MR. TOOMAN: Object. 

THE COURT : Overruled . 

MAJOR FEIN: Your Honor, permission to 
publish 194 Charlie and 193 Charlie. 

THE COURT: Go ahead. 

BY MAJOR FEIN: 
Q Special Agent Shaver, how are those two 

documents related? 

MR. TOOMAN: Assuming our objection will be 

overruled . 

MAJOR FEIN: United States moves to admit 
Prosecution 193 Charlie and 194 Charlie for 
identification as 193 Charlie and 194 Charlie. 
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THE COURT: Defense, just for the record, 
your objection is overruled. I understand you made the 
same objection. 

MR. TOOMAN: Thank you, Your Honor. 
THE COURT: Prosecution exhibits 193 
Charlie and 194 Charlie are admitted. 
BY MAJOR FEIN: 
Q Special Agent Shaver, in reference to our 

searches for Twitter on PFC Manning's personal 
Macintosh, why did you or your office not search for 
Twitter related information prior to the past few days? 
A We didn ' t know it was important . 

Q What do you mean by that? 

A The focus of the original exam was to find 

government data, State Department data. So documents, 
things along that nature, Guantanamo Bay. 

Q Now, I ' d like to focus your testimony on a 

specific e-mail that you pulled as part of the forensic 
exam in the last few days . 

Over or the past week did the prosecution 
ask you to search PFC Manning's computer to any e-mails 
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related to the New York Times? 
A I did. 

Q What did you find? 

A I found one message. 

Q How did you find it? 

A PFC Manning's computer was configured to 

use . 

Q I'm sorry, what computer? 

A PFC Manning's personal computer. 

MR. TOOMAN: Before we go further, the 
substance of this e-mail doesn't invoke Wikileaks at 
all. There's no explicit reference to Wikileaks, it 
doesn't discuss PFC Manning's views on Wikileaks. 

An e-mail to the New York times, in our 
view, doesn't have any bearing on whether or not 
Wikileaks is a journalistic organization. 

THE COURT : Do you want to see the e-mail . 

(INAUDIBLE) . 

MAJOR FEIN: May I have a moment, Your 

Honor . 

THE COURT : Yes . 
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MAJOR FEIN: Your Honor, although there 
are two documents the United States intends to use 
they're identical except for the way the message was 
pulled. I'm handing you what's been marked as 
Prosecution Exhibit 195 Bravo for objection. 

THE COURT: What's the point of this? 

MAJOR FEIN: Your Honor, United States is 
offering this e-mail to rebut the inference that PFC 
Manning thought Wikileaks was a legitimate news 
organization because this e-mail shows that if he had 
identified something that was news worthy he would have 
actually gone and he tried to go or to the New York 
Times . 

So if the defense is arguing what PFC 
Manning did or didn't know, then this would be 
equally permissible inference that he knew what 
legitimate was and that's not what he used it for, 
and also note the date, Your Honor, dated April 8th 
which the United States will argue, if it's 
admitted, which was just a few days after the public 
release of the Apache video and then contacted the 
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New York Times about it . 

THE COURT: Why is it in the rebuttal case? 

MAJOR FEIN: Because the defense is — the 
defense offered the idea that PFC Manning would know 
what legitimate press was through Professor Bangler and 
once they offered that, Your Honor, the United States 
is rebutting if that ' s going to be the inference . 

They argue that in rebuttal that he knew 
what it actually was and not Wikileaks and his 
actions are not consistent with that argument but 
until the defense makes that argument United States 
would offer it's not even relevant for that reason. 

THE COURT: I don't see the connection. 
I'm going to sustain the objection on this one. 

MAJOR FEIN: Yes, ma'am. May I have a 
moment, Your Honor? 

THE COURT : Yes . 

BY MAJOR FEIN: 
Q Now I ' d like to direct your testimony to a 

SigAct, a specific SigAct . Over the past week did the 
prosecution ask you to search PFC Manning's personal 
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computer for information related to an Iraqi publishing 
concerning propaganda in 2010? 
A Yes . 

Q And what did you find? 

A Within the unallocated space of PFC 

Manning's personal computer personal Macintosh, there 
was a deleted SigAct . 

Q How did you find that SigAct? 

A Based off of examination of text file I was 

able to — I looked down and I was told the SigAct 
involved a printing organization, a printing, and some 
people were arrested. Based off volumes. text there was 
text files saying arrests . 

Things along that nature, and based in that 
same — on that same CD that was burned was a appeared 
to be a CIDNE key, a CIDNE tracking key, and I searched 
for that . 

MAJOR FEIN: Your Honor, permission to 
public Prosecution Exhibit 127 . 

THE COURT: Go ahead. 
BY MAJOR FEIN: 



Provided by Freedom of the Press Foundation 



1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 



UNOFFICIAL DRAFT - 7/18/13 Afternoon Session 

151 

Q Special Agent Shaver, do you recognize this 

document? 

A I do. 

Q What is it? 

A It is a volume subtext . 

Q And very quickly and generally what does 

this reflect? 

A This is the CD volumes that had been 

accesses and recovered from the unallocated space of 
PFC Manning's machining personal computer. 

Q What do you mean by volume? 

A A column is volume is a CD in this case . 

It's just mounted. 

Q What is the numbers after volume slash and 

then there's numbers? 

A That's a date, time donation. So, for 

example, line 18 is March 4th, 2010, at 2258 hours, 
that was burned . 

Q And then what ' s the last part of that , what 

does that denote? 

A Line 18 . 
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Q 



Sure . 



A 



That appeared to me to be a CIDNE report 



key . 



Q 



But in general what is it? 



A 



Those are the files on a CD. 



Q 



So what did you do with volume . txt in order 



to find this SigAct? 



A 



I looked at that — I saw — I remember 



seeing the propaganda arrest notes . I thought that 
might have something to do with it, and, again, I 
noticed what appeared to be a CIDNE tracking key which 
is line 18 . 



search, of the unallocated space, and I was able to 
locate the document in question. 



Manning ' s personal Macintosh computer . 

I now want to hand you what ' s been marked 
as Prosecution Exhibit 196 for identification, but I'm 
going to move this cover in front of you. I'm handing 
you Prosecution Exhibit 196. 



I then used that as a search, a key word 



Q 



What computer did you located it on. PFC 
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Will you please keep it and look up and 
you're finished. 

A Yes, sir. 

Q What is that? 

A This is the recovered SigAct that I spoke 

of. 

Q And how do you recognize it? 

A This is an EnCase report of that . This is 

something I created and my initials are on it . 
Q And where was it located? 

A The unallocated space of PFC Manning ' s 

personal Macintosh computer . 

MAJOR FEIN: Your Honor, United States 
moves to admit Prosecution Exhibit 196 for 
identification as Prosecution Exhibit 196. 

MR. TOOMAN: No objection. 
THE COURT: May I see it, please? 
Prosecution Exhibit 196 for identification is admitted. 

MAJOR FEIN: Thank you, Special Agent 
Shaver. No further questions. 

THE COURT: Defense? 
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CROSS EXAMINATION BY MR. TOOMAN : 
BY MR. TOOMAN: 
Q We meet again, Special Agent Shaver. 

A Yes, sir. 

Q Let's start off by talking about WGet? 

A Yes, sir. 

Q I'd like to retrieve Prosecution 

Exhibit~100, please. 

MR. TOOMAN: Ma'am, permission to publish. 
THE COURT : Yes . 
BY MR. TOOMAN: 
Q Agent Shaver, what we see on Prosecution 

100 are essentially the links to the NCD database, 
correct? 

A Yes . 

Q And it ' s one — if one wanted to go view 

we'll look at the very top line here line 10926. If 
one wanted to view that 10 canbara 153 cable what would 
they put into their machine? 

A You would start from where it says HTTP and 

would you copy that all the way through 153 and put 
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that in the web browser . 

Q Showing you Prosecution Exhibit 187. 

MR. TOOMAN: Permission to publish, ma'am. 
THE COURT : Yes . 
BY MR. TOOMAN: 
Q When you talked on direct you talked about 

the process through which one would get cables from the 
NCD, right? 

A Yes . 

Q One of the ways of what you talked about 

was someone going to the web page, so basically the NCD 
home page? 

A Yes . 

Q And once they got to the NCD home page they 

could do a search? 
A Yes . 

Q Once they did a search they might see a 

number of links come up, correct? 
A Correct . 

Q And they could click on that link, correct? 

A Yes . 
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Q And then that link would take them to a 

page? 

A Sure . 

Q Perhaps that cambera table cable we just 

talked about? 

A Yes . 

Q If the person new the URL for that cambera 

cable they could just type that directly into their 
browser, wouldn't they? 

A Correct . 

Q So a user doesn ' t have to go to the home 

page, the NCD home page, in order to access a cable? 
A Correct . 

Q So if you just talked about that URL and if 

I just typed that in as a web browser I ' d go to that 
cambera page? 

A You would. 

Q So I don't have to go to that home page, in 

other words, to get that to cambera cable? 
A Correct . 

Q And the naming convention for Department of 
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State cables is the same for those web pages the same 
for every one, NCD up to the MRN? 
A Yes . 

Q And then you put in the MRN . HTML and you 

get to the cable? 

A Correct . 

Q Now, you talked about the process through 

which PFC Manning got these cables and you said that 
what he did was he went to the home page, he went to 
the NCD home page; is that correct? 

A Yes . 

Q And did search to find the most recent 

cables? 

A Yes. 

Q And he copied that? 

A I'm assuming on that one. I'm assuming. 

Q So he would have done a copy control C and 

pasted it into Excel? 
A Correct . 

Q And that Excel document is what you used in 

order to help him write whatever script used for WGet? 
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A Right . 

Q You testified on direct — I'm going to 

flip over here to page 2 and publish that . WGet can 
just go directly to the server? 

A Correct . 

Q But it's also possible — I'm on putting 

page one back up — that a user could go to the home 
page, copy, paste, or they could go to the home page 
and do the search and pull up the cables . They can 
have the home page up. They could copy that 
information, put it into their Excel, correct? 

A Yes. 

Q Put it into WGet and while the web browser 

is still open run WGet, correct? 
A Correct . 

Q And there ' s no evidence to suggest that PFC 

Manning didn't do that, correct? You can't say that he 
didn ' t have the NCD database open when he was running 
WGet? 

A That ' s correct . 

MR. TOOMAN: Removing Prosecution 
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Exhibit 187 . 

THE COURT: Let me stop you for just a 
minute . That was fast . Explain to me what path you 
just described for WGet once again. 

MR. TOOMAN: You want me to go through the 
questions again? 

THE COURT : Yes . 

BY MR. TOOMAN: 
Q Now, I'll retrieve Prosecution Exhibit 187 

and publish. 

THE COURT : Yes . 

BY MR. TOOMAN: 
Q Now, you talked about the process through 

which PFC Manning got MRNs, correct? 
A Correct . 

Q And the process was going to NCD home page? 

A Yes . 

Q Do a search for the most recent? 

A Yes . 

Q Find out what those are? 

A Yes . 
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Q At that point they're on the screen? 

A Yes . 

Q There's a list of MRNs on the screen, 

correct? 

A Yes . 

Q Highlight them? 

A Yes . 

Q Copy them? 

A Yes . 

Q Paste them into Excel? 

A Correct . 

Q Then using Excel PFC Manning would have 

written whatever script he was going to use in WGet? 
A Correct . 

Q And then WGet would have ran and done its 

thing and got the cables? 
A Correct . 

Q When that was happening the NCD home page 

could have been open? 
A Yes . 

Q And there's no evidence in your analysis of 
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PFC Manning ' s Mac computer to suggest that he didn ' t 
have the NCD home page open when he ran WGet? 

A Sir, do you the mean .22? 

Q Yes. Thank you, the .22. 

So there's no evidence on the .22 machine 
that when PFC Manning wag running WGet the NCD home 
page wasn't open? 

A Correct, because Internet history was set 

to be cleared. 

Q So it ' s quite possible that PFC Manning did 

the copy, had NCD open, pasted it into Excel, got it 
into WGet and ran WGet while he was still on the NCD 
home page? 

A Correct . 

Q Or on the NCD search results? 

A Yes . 

MR. TOOMAN: Removing Prosecution 
Exhibit 187 for Prosecution Exhibit 187 returning it to 
the court reporter . 

BY MR. TOOMAN: 
Q Now, you talked briefly on direct about 
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something called HBSS, was does that stand for? 

A Post based security system. 

Q And you said on direct that HBSS had the 

ability to prevent the user from running an executable 
file? 

A Yes . 

Q A self-executable file could have been 

prevented by HBSS? 
A Yes. 

Q And you also said that HBSS was in the 

possession of the Army at the time all of this 
happened? 

A Yes . 

Q The Army had it? 

A Yes . 

Q And the Army could have put on it all the 

systems, it was software we had? 
A Yes . 

Q And if the Army had wanted to they could 

have set it up so a user couldn't run a self-executable 
file? 
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A Correct . 

Q Understand the Army didn't do that? 

A Not to my knowledge . 

Q I would like to retrieve prosecution 



Exhibit 188, please. 

MR. TOOMAN: Permission to publish. 
THE COURT: Go ahead. 
BY MR. TOOMAN: 
Q Special Agent Shaver, this is Prosecution 

188 and these prefetch files? 
A Correct . 

Q And what the prefetch files tells us is 

that basically their program was run? 
A Yes . 

Q And we see in I guess the fourth column we 

see the date that it was last burned? 
A Correct . 

Q Now, what we don't know from the prefetch 

files how long the program ran, correct? 

A That's not quite right, sir. 

Q Can you tell from the prefetch files if the 
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program ran for 30 seconds or it ran for a minute? 

A I can tell from the prefetch that they ' ve 

got — they ran, how many times it ran. So in the case 
of the last one bloop, number 20, excuse me, it was 
only run one time. So you have a date it was created, 
was that time, and the date it was last run would be 
the ending time. In that case, yes. 

Q You can tell how long this one ran? 

A It only ran one time . 

Q Now, when number 20, so we see it started 

at 2010 on 3 May and it ran until 02 of May 4, right? 
A Yes . 

Q There are no other instances of WGet 

running at that time, correct? 
A Correct . 

Q And so let ' s just look at number one . When 

it ran on 1 April at 12:21 '08 8 you don't know how 
long it ran, do you? 

A Correct . 

Q So you don ' t know if while it was running 

there was another instance of it running? 
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A I mean, the dates and times on the files 

were created. If you look at first line. Again, go to 
the first created date. The created time is 13:48:34 
followed by 13 on the next line is 13:48:40. That's a 
few seconds apart, and you continue going down they're 
there ' s seconds apart from each other . 

Q But it's possible that that ran for five 

seconds? 

A It is possible. 

Q And then the next one opened up 4 and that 

ran until 4844, and the third one opened up? 
A It is possible. 

MR. TOOMAN: Removing Prosecution 

Exhibit 188. 

Retrieving publication 189. Permission 
to publish, Your Honor. 

THE COURT: Go ahead. You can publish 
anything that's been admitted. 

MR . TOOMAN : Thank you , ma ' am . 

BY MR. TOOMAN: 
Q Prosecution Exhibit 189 basically the help 
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file or introductions on different things you can do 
with WGet, correct? 

A Correct . 

Q Now, I want to direct your attention down 

to the last section there HTTP options? 
A Okay . 

Q Now, if we look under there you would say 

that it was possible that WGet — to set WGet up so 
that if you are accessing or if you were going to a 
website that required a password and a user name you 
could set WGet up to provide that password and user 
name? 

A Correct . 

Q And so if on the NCD database a user needed 

to put in a user name and a password to get access you 
could have done that on WGet? 

A Correct . 

Q Now, you talked about certain batch files 

or the script that was run by PFC Manning on the .22 
machine . You didn ' t see anything where there was a 
user name or password included in the scripts, correct? 
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A Correct . 

Q And why wouldn ' t there have been a user 

name or password in the scripts? 
A It's not required. 

MR. TOOMAN: Removing Prosecution 

Exhibit 189. 

BY MR. TOOMAN: 

Q So it wasn ' t required because once an 

individual logged on to their SIPRnet machine they had 
access to the (INAUDIBLE) . 

A Correct . 

Q They didn ' t have to put any other 

information in their computer at any time to get 
(INAUDIBLE) ? 

A Correct . 

MR. TOOMAN: If we could retrieve 
Prosecution Exhibit 191. 

BY MR. TOOMAN: 

Q Special Agent Shaver, you testified about a 

number of batch files . 

A Correct . 
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Q I'd like to talk about little bit more 

about what batch file as . Within a batch file there 
are a series of commands, correct? 

A Correct . 

Q There's multiple lines within the batch 

file? 

A Yes . 

Q And each one of those lines is a command or 

an introduction? 

A Correct . 

Q So let's just look at I up there, or let's 

actually look at E, echo. Within that bat file there 
were a number of introductions or commands? 

A Okay . 

Q Is that — 

A There could be . 

Q Well, that's what a batch file is, right? 

A Yes . 

Q What would you expect to see in there since 

these were the batch files used to get the cables you 
would expect to see that WGet introduction in there, 
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correct? 

A Correct . 

Q And you would expect to see each line would 

be a different instruction? 
A Yes . 

Q So the first line might be to get using 

MRNs that we're just going to make up 09 Vienna 1. 
That would be the first cable from Vienna in 2009 and 
the next line would be 09 Vienna 2, possibly? 

A Sure . 

Q One actually ran the bat file what would 

happen is WGet would go and then get 09 Vienna, right? 
A Yes . 

Q And then after it got 509 Vienna 1 would it 

go back and get 09 Vienna 2 because that was the next 
line and it would go through until all of the 
instructions were done? 

A Yes . 

Q And it would do them one at a time? 

A Yes . 

Q That's why when you testified on the merits 
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you talked about firewall, right? 
A Yes. 

Q DOS firewalls . There are hundreds of 

thousands of connections? 
A Correct . 

Q Between the 22 machine and the 40 machine 

and Department of State, and the reason there were so 
many connections was because these were coming in one 
at a time? 

A Yes . 

Q When those batch files run it ' s not 

downloading two or three cables at a time? 

A It's doing the first command completing it 

and then the second command . 

Q Now, I just want to talk sort of generally 

about the big picture about WGet . WGet is a program 
that ' s in open source? 

A Correct . 

Q And it ' s not a program that ' s known for 

being synonymous with hackers, correct? 
A It could be . 
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Q It could be, but it's not necessarily? 

A Correct . 

Q It ' s used for purposes by a lot of 

different people? 
A Yes . 

Q And a lot of those people aren't hackers? 

A Yes. 

MR. TOOMAN: Can I have a moment, Your 

Honor? 

THE COURT : Yes . 
BY MR. TOOMAN: 
Q Special Agent, I want to talk now about the 

tweets. Before we go to the tweets, I want to talk 
about the f abacons . I can retrieve Prosecution Exhibit 
192. I'm removing prosecution 191. Publishing 192. 

You talked about finding these in the 
allocated space? 

A Correct . 

Q And generally speaking the allocated space 

are the nondeleted things? 
A Correct . 
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Q And when we talked yesterday you told me 

that it's possible to have a fabacon on your computer 
without ever having visited the site? 

A No, sir. 

Q But even if there was a fabacon present on 

the computer, you don't know if the person actually 
visited the site actually saw it? 

A That ' s part of the code actually of HTML . 

I would have to say, no, sir. 

Q So it ' s possible that there are times when 

you ' re reading something in the news and you click on a 
clinic link and the link opens up in a new tab, right? 

A Yes, sir. 

Q And then you just forgot about it, you 

forgot that it's there? 
A Yes, sir. 

Q You close your browser, it's gone? 

A Yes, sir. 

Q You never saw that article? 

A Correct . 

Q That article is open on your computer 



Provided by Freedom of the Press Foundation 



1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 



UNOFFICIAL DRAFT - 7/18/13 Afternoon Session 



173 

right? 

A Yes, sir. 

Q And if that article on that website had had 

a fabacon that would be in your allocated space? 
A It would be . 

Q But you didn't actually see the article? 

A That ' s correct . 

Q And while there are these fabacons you 

don ' t actually know if it was viewed you can ' t say when 
it was viewed? 

A Correct . 

MR. TOOMAN: Removing Prosecution Exhibit 

182 . 

BY MR. TOOMAN: 
Q Let ' s talk about the tweets . Now the 

tweets again you found URLs, correct? 
A Correct . 

Q In the unallocated space? 

A Yes. 

Q Now, when you searched the unallocated 

space for Twitter? 
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A Yes . 

Q You found I think 11 instances of Twitter 

in the unallocated space? 

A Twitter and Wikileaks . 

Q Okay . And I want to just talk about the 

instances of Twitter. Okay? 
A Okay . 

Q You didn't find — well, actually all you 

found related to Twitter in the unallocated space were 
those URLs, correct? 

A Correct . 

Q When you searched the unallocated space 

both previously, years ago, and then most recently this 
week or last week you recovered a number of web pages, 
right? 

A Correct . 

Q And none of those web pages were 

Twitter.com, correct? 

A I do not recall them being Twitter . 

Q So when you find these instances of Twitter 

that we talked about today, it's the URL, right? 
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A Correct . 

Q But there ' s not actually evidence that URL 

was pull up on the computer? 

A Correct . 

MR. TOOMAN: I'd like to retrieve Defense 
Exhibit igloo igloo . 

BY MR. TOOMAN: 

Q I'm handing you India India for 

identification . 

A Thank you, sir. 

Q What is that? 

A This is a recovered web page from the 

unallocated space. This web page has my initials next 
to it . 

Q How do you know that's what it is? 

A Because I was there when it was created. 

Q How did you find or how was this article 

found? 

A This article was found based first 

identifying the location of the two tweets, the two 
tweets that I spoke of earlier, the ones. Those were 
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embedded in this web page . 

MR. TOOMAN: I'd like to retrieve Exhibits 
194 Charlie and Bravo, please. 

BY MR. TOOMAN: 
Q Special Agent Shaver, I've published 194. 

Are these the URLs that you used to find that article? 
A Correct . 

Q Removing 194 Bravo and Charlie. Retrieve 

Defense Exhibit India India for identification. 
BY MR. TOOMAN: 

Q Now, Agent Shaver, why did this article 

come up when you searched the unallocated space for 
those URLs? 

A Because they ' re embedded links . 

Q Where in this article do you recall were 

those links embedded? 

A I don't remember which link went to which 

one but, approximately from the bottom to the top, 
starts earlier the fourth up, the link file from the 
left, earlier Wikileaks versus Twitter. 

Basically fourth paragraph up Wikileaks 
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Twitter feed. That is one, and another one was in the 
paragraph started all the tweets came out in a rush. 

Q Agent Shaver, this article was found in the 

unallocated space of PFC Manning's Mac computer, 
correct? 

A Correct . 

Q So that means that at some point this 

article was pulled up on his computer? 
A Yes . 

Q You don ' t know if he actually clicked on 

the link and followed it, correct? 
A Correct . 

Q Because we don ' t have any actual 

Twitter.com web pages? 
A Correct . 

Q I'd like to have you read — actually if 

you could just read the third paragraph? 
A Starts with word Assange? 

Q Yes . 

A Assange was traveling to speak at an 

investigative journalism conference in Norway and told 
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SBS that, quote, U.S. sources told Iceland state media 
that the U.S. State Department was aggressively 
investigating a leak from the U.S. embassy in 
(INAUDIBLE), end quote. 

MR. TOOMAN: Removing Defense Exhibit for 
identification India India and offering it as Defense 
exhibit . 

THE COURT: Any objection? 
MAJOR FEIN: No, ma'am. 
THE COURT: It is admitted. 
BY MR. TOOMAN: 
Q I'd like to talk now about the other tweet, 

the third tweet. Retrieving prosecution Exhibit 193. 

Agent Shaver, this tweet includes a link, 

correct? 

A Correct . 

Q And you've gone to that link, correct? 

A I have . 

Q And that link offers — it ' s an article on 

f aulker . com ( INAUDIBLE ) ? 
A Yes . 
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Q And it's an explanation of the tweet, it 

elaborates on it? 
A Yes . 

Q That article says is that Facebook deleted 

a fan an unofficial Wikileaks page, correct? 
A Yes. 

Q And they did that because it ' s their policy 

that they don't want to confuse users of Facebook, 
right? 

A Yes . 

Q And if there's an unofficial page that can 

be confused with the official page, they'll take down 
the unofficial page, and then what they do is they 
migrate the user from the unofficial page over to the 
official page? 

A Yes, sir. 

MR. TOOMAN: Removing prosecution Exhibit 

193 Alpha. 

BY MR. TOOMAN: 
Q Let ' s talk about the SigAct . Okay? 

A Yes, sir. 
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Q Now, the SigAct you found reference to in 

the value mountain data, correct? 
A Correct . 

Q How you found it was there was a SigAct of 

interest, correct? 
A Okay . 

Q You were asked to find something — 

A Yes . 

Q — referencing or related to a particular 

SigAct? 

A Correct . 

Q And when you looked at the SigAct, the 

actual SigAct? 

A Actually, no. 

Q You were given? 

A Some basic information. 

Q Basic information from the government? 

A Yes . 

Q One of the pieces of information you were 

given was the CIDNE sort of the identifying number of 



the SigAct? 
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A No. I was basically told it was a SigAct 

involving press printing and arrest of people . 

Q And so you did some key word searches and 

you found part of these SigAct s? 

A Yes . 

Q And then once you had a piece of that 

SigAct up that SigAct has some sort of identifying 
number on it? 

A Yes. 

Q And then you took that identifying number, 

right, and then you searched PFC Manning's computer for 
other instances of that identifying number? 

A I did. 

Q One of the things you found was a file on a 

CD that had been mounted on PFC Manning ' s computer? 
A Correct . 

Q So basically at some point PFC Manning put 

a CD in his computer and on that CD was a file a . TXT 
file, right? 

A I don ' t know the extension . 

Q There was a file and the name of that file 
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was the same as the ID number for this SigAct? 
A Correct . 

Q You don't know if that file was actually 

the SigAct? 

A Correct . 

Q But it ' s a pretty random number to have 

been anything else? 

A I would agree with you. 

Q Now, you found a bunch of SigAct s in the 

course of your investigation over all the different 
pieces of medium associated with PFC Manning, correct? 

A Yes . 

Q PFC Manning ' s charged with taking hundreds 

of thousands of SigAct s and giving them to Wikileaks 
and you found all of those? 

A Yes. 

Q And you found those on an SD card? 

A Correct . 

Q Could you tell the Court how those were 

named individual? 

A I'm not sure how to answer that question, 



Provided by Freedom of the Press Foundation 



1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 



UNOFFICIAL DRAFT - 7/18/13 Afternoon Session 



183 

sir. I found them in the unallocated space of the SD 
card. So they had no file names. Within the 
(INAUDIBLE) the encrypted file, they were located 
within two SCV files. So each entry within those files 
was SigAct . 

So, I'm sorry I don't know how to answer 
that question. 

Q You can't answer that question because they 

weren't individually saved, right? 

A Correct. It's in mass. 

Q They were in the CSV file, right, and the 

CSV file is associated with Excel . That ' s probably the 
easiest way to open a CSV file. 

A Correct . 

Q Those SigActs you found weren't 

individually downloaded? 

A I don ' t know . 

Q When you found them they were all grouped 

together, correct? 
A Yes . 

Q And they were grouped together in the SCV 
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files, right? 

A Yes . 

Q And those files were in yada? 

A Yes (INAUDIBLE) . 

Q So the SigAct that we ' re talking about now 

wasn't downloaded with all of those or it wasn't kept 
with all those? 

A Right . 

Q Those were all kept on an SD card? 

A Yes . 

Q This one was kept on his personal 

Macintosh? 

A Correct. Sir, but the dates were wrong. 

Q Okay . 

A The dates on the SD cards is 2009 prior. 

That one happened in 2010. 

Q So this was one that was completely 

separate from those ones on the SD card? 

A Correct . 

Q Those were 2009. This one is dated 2010? 

A Yes . 



Provided by Freedom of the Press Foundation 



1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 



UNOFFICIAL DRAFT - 7/18/13 Afternoon Session 



185 

Q And when you looked at the volume mounting 

data and you saw that CIDNE— ID number, you didn't see 
other volume mounting data with CIDNE— ID numbers, did 
you? 

A Did not . 

Q So there were no orders files that had been 

put on a CD that had the same I guess naming convention 
as the CIDNE-ID number? 

A I did not see any. 

Q So it would seem that this particular 

SigAct was in some way unique? 
A Yes . 

Q It was downloaded and saved individually? 

A Yes . 

Q Separate and apart from all of the others? 

A It appears so, yes. 

Q I want to talk to you about some of those 

web pages you mentioned that you found when you 
searched the unallocated space of PFC Manning ' s Mac . 

A Okay . 

Q You found a number of fragments is what 
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they are, correct? 

A Correct . 

Q And what you all did when you did your 

forensic report, you and Mr. Johnson, you created 
attachments, right? 

A Yes. 

Q And one group of attachments, attachment S, 

was a number of articles that implicated Wikileaks? 
A The key where Wikileaks was present in 

them. 

Q So anything you found that sort of invoked 

Wikileaks, any web page fragment would have gone into 
attachment S, correct? 

A Correct . 

MR. TOOMAN: I'd like to retrieve Defense 
Exhibit Kilo Kilo for identification. 
BY MR. TOOMAN: 

Q Agent Shaver, what is that? 

A It ' s a two— page — it looks like a 

recovered web page . 

Q This is an example of a web page fragment 
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that you would have found? 
A Yes . 

Q Is this one that you did find? 

A It was marked as such. I don't recall this 

one specifically, but it was marked in accordance the 
way we marked the files. 

Q What markings in particular suggest to you 

that this was one that you had found? 

A It has our case numbers on it . It has to 

(INAUDIBLE) on it, the foyer LES classification marking 
attachment S, the font's the same. 

Q Now, Agent shaver, I'd like you to read on 

page one of that exhibit for identification there's 
basically a paragraph of text. Could you read that, 
please? 

It starts, by releasing such a graphic 

video . 

A By releasing such a graphic video which a 

media organization has tried in vein to get through 
traditional channels, Wikileaks has inserted itself in 
the national discussion about the role of journalism in 
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the digital age . 

Q You can stop there . 

A Okay . 

MR. TOOMAN: I'm going to retrieve Defense 
Exhibit Kilo Kilo offered as a Defense exhibit . 
THE COURT: Any objection. 
MAJOR FEIN: No, ma'am. It's part of a 
longer exhibit . 

THE COURT: I assume you want it 
separate from that larger exhibit? 

MR. TOOMAN: Yes, ma'am. 
THE COURT: It's admitted. 
BY MR. TOOMAN: 
Q That again was something that was found on 

the unallocated space of PFC Manning's Mac? 
A Correct . 

Q Which means at some point it was up on the 

screen? 

A Yes . 

Q Again, you can't say for sure whether or 

not he saw it? 
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A Correct . 

Q But it was up on the screen? 

A Yes . 

MR. TOOMAN: I'd like to retrieve Defense 
Exhibit Lema Lema for identification. Permission to 
publish, ma'am. 

THE COURT: Go ahead. 
BY MR. TOOMAN: 
Q Sorry, I'm not the supposed to do that. 

I'm going to hand this to the witness. 

Agent Shaver, what is this? 
A Again, it appears to be another file from 

attachment S from the forensic report . 
Q How do you know that? 

A The markings are on it . 

Q Agent Shaver, I'd like to direct your 

attention to the first page, actually page 2. 
A Okay . 

Q And there ' s the first full paragraph that 

says Sunshine Press . Would you read that please? 
A The full paragraph? 
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Q Please. 

A The Sunshine Press (Wikileaks) is a 

nonprofit organization funded by human rights 
campaigners, investigative journalists, technologists, 
and the general public . Through your support we have 
exposed significant injustice around the world. 
Successfully fighting off over 100 (INAUDIBLE) in the 
process . Although our work produces reforms daily and 
it is the recipient of numerous prestigious awards 
including the 2008 index of censorship, Congress of 
Freedom of Expression award as well as the 2009 NSD 
International New Media Award. These accolades do not 
pay the bills . 

Q You can stop there, Agent Shaver. Thank 

you . 

MR. TOOMAN: Retrieve this for the witness 
and offer Defense Exhibit Lema Lema as Defense Exhibit 
Lema Lema . 

MAJOR FEIN: No objection. 

THE COURT: How many of these articles are 
we going to go through? Can we show them all and have 
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him read what you want to read all of them? 

MR . TOOMAN : They are four more . 
THE COURT: They're all admitted? 
MR. TOOMAN: Yes, ma'am. 

THE COURT : Does the government want the 
Defense to go through a foundation for each of these? 
MAJOR FEIN : Absolutely not . 

THE COURT : I'm admit them all , and you can 
have the witness read whatever, attachment S? 

MR. TOOMAN: Yes, ma'am. 

THE COURT: So you have permission to 
publish Exhibit Lema Lema and Defense Exhibits Mike 
Mike, Defense Exhibit November November, Defense 
Exhibit Oscar Oscar, and Defense Exhibit Papa Papa, and 
they're all admitted. 

Captain Tooman, here you go. 

MR . TOOMAN : Thank you , ma ' am . 

BY MR. TOOMAN: 
Q I'm going to hand Mike Mike, November 

November, and Oscar Oscar, and Papa Papa to the 
witness . 
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A Okay . 

Q Agent Shaver, let's look at Defense Exhibit 

Mike Mike, and I'd like you to look at page 2. 
A Okay . 

Q And the third — I guess the fourth 

paragraph down starting the most recent opening? 
A Yes . 

Q Could you read that and then the following 

paragraph, please? 

A Most recent openings in the haze of 

immediate and political hypocrisy the near (INAUDIBLE) 
release of civilian and of U.S. forces in the Iraq and 
Afghanistan. The now ubiquitous Wikileaks video 
footage of soldiers firing on orders of photographer at 
(INAUDIBLE) is and other civilians in Baghdad in 
July 2007 was equal and graphic power by the 
acquisitions that in February of 2010 U.S. Special 
Forces personnel had not only killed two pregnant women 
along with a teenage girl and two local officials in 
Kandahar against them but caused the bullets out of 
bodies to remove evidence out of responsibilities for 
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their debts. 

Q Move on to defense Exhibit November? 

A Okay . 

Q And if you can please read the paragraph 

starting with has become increasing hard to ignore. 

A (INAUDIBLE) Have been ignored over the 

years. (INAUDIBLE) to some media watchers far exceeds 
that of even established news organizations. 

Q Thank you . On to Oscar Oscar . And if you 

could, read there at the top of page one an in open 
plat form? 

A An open platform for the anonymous 

publishes and compromising documents according to Time 
Magazine. Wikileaks could become as important a 
journalistic tool as the Freedom of Information Act . 

Q You can stop there . And finally Defense 

Exhibit Papa Papa. If you could look at page 4 down 
towards the bottom you see a heading collateral murder 
in Iraq? 

A Yes . 

Q The United States military video, if you 
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could read the first two sentences their please? 

A The United States military video was 

released week showing the indiscriminate targeting and 
killing of civilians in Baghdad. The nonprofit news 
organization Wikileaks obtained the video and made it 
available on the Internet? 

MR. TOOMAN: I'll retrieve those exhibits 
from the witness . 

MAJOR FEIN: No further questions. Thank 

you . 

THE COURT: Redirect. 
MAJOR FEIN: Yes, ma'am. 
REDIRECT EXAMINATION BY MAJOR FEIN: 
BY MAJOR FEIN: 
Q You're almost finished and possible for the 

whole court . 

THE COURT: Is this going to be a long or 
short redirect? I'm looking at whether we need a 
recess? 

MAJOR FEIN: Short, ma'am. 

THE COURT : Why don ' t we do that . Let ' s 
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take a quick ten— minute recess . During the recess if 
you could you please, I'd like for you to come see me 
just so we can talk about the way ahead. 

The Court is in recess until 1900 or 

7:00. Okay. 

(Hearing recessed at 7:00 p.m.) 
(Hearing resumed at 7:10 p.m.) 
THE COURT: The witness on the witness 
standard. Major fine. 

BY MAJOR FEIN: 
Q Special Agent Shaver in reference to your 

testimony just now on cross examination on WGet a few 
questions . You testified about if you knew the web 
address the URL for a specific cable you can type that 
into a web browser? 

A Correct . 

Q What did you mean by that? 

A If you go to the address bar, open a web 

browser, look in the address bar and type that in as 
the actual path to the f ile . So it would appear in 
your web browser . 
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Q What program was installed on the .22 and 

.40 computers that allowed its users to view web pages? 

A Internet Explorer and Firef ox . 

Q And what program installed on .22 and .40 

allowed individuals to navigate to web pages to view 
web pages? 

A Internet Explorer and Firef ox . 

Q What about to download, what program was 

installed on .22 and .40 to allow users to download? 

A Internet Explorer and Firef ox . 

Q You testified about that it was possible to 

of having the NCD web page, the web page for the 
database open in one window and running WGet in the 
other. Do you remember that? 

A Correct . 

Q How does one relate to the other? 

A Well, besides the observe that they're both 

running on the same computer and both connecting to the 
State Department, but otherwise no. 

Q Does having the NCD database web page up in 

a browser effect running WGet get at all? 
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Are they operating independently of each 
Yes , they ' re independent . 

And is the program WGet the same as a web 



No. 



A No 

Q 

other? 

A 

Q 

browser? 
A 

Q And actually now just direct your attention 

or focus your testimony on the SigAct and some of the 
information you testified about in cross examination. 

You testified that you didn't find any 
other information about that SigAct on his personal 
Mac, correct? 

A Correct . 

Q Did you find any other information 

reference that go SigAct on any other evidence you 
examined? 

A I did. 

Q Where did you find another copy of that 

SigAct in its entirety? 

A Within the Bradley Manning profile on the 
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T-Drive . 

Q Did you compare the two? 

A I did. 

Q What how do they compare? 

A The one on T— Drive is the complete . 

Q Was the one? 

THE COURT: What. 
THE WITNESS: Is complete. 
BY MAJOR FEIN: 
Q And why is the other one not completed? 

A Unallocated partially deleted. 

Q For the one that was complete, was it a 

individual file or per the larger Excel spreadsheet? 
A It was an individual file. 

MAJOR FEIN: Thank you. No further 
questions, Your Honor. 

RECROSS EXAMINATION BY MR. TOOMAN : 
BY MR. TOOMAN: 
Q Special Agent Shaver, when a user employs 

WGet to download a cable and on is their computer 
forever, whatever place that they have it, it's on the 
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computer and the user can then view it, correct? 
A Yes . 

Q Let's use our 09 Vienna one cable? 

A Okay . 

Q Hypothetical cable . You download that with 

WGet . That's now on your computer, correct? 
A Correct . 

Q You can view that cable, correct? 

A Yes . 

Q And if you double click on that cable how 

does it open up? 

A It would open with your default browser . 

Q So Internet Explorer or Firefox? 

A Correct . 

MR. TOOMAN: No further questions. 
THE COURT: I don't think I have any 
questions . Temporary or permanent . 

MAJOR FEIN: Unfortunately for him, 

temporary . 

THE COURT: You are temporarily excused. 
The same rules apply. Do not discuss your testimony or 
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your knowledge of the case with anyone other than 
counsel or the accused while the trial is still going 
on . 



conference about ten minutes ago to discuss the way 
forward. Understanding the hour, PFC Manning needs to 
eat, we have additional rebuttal and sire rebuttal 
testimony to go forward. So we're going to resume 
tomorrow morning at 09:30. 



THE WITNESS: Thank you, ma'am. 



THE COURT: 



I met with counsel at a RCM802 



Is there anything else we need to 



address? 



MR . COOMBS : No , Your Honor . 



MAJOR FEIN: 



No , ma ' am . 



THE COURT: 



Court is in recess until 09:30 



tomorrow morning . 
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